24477ba41ebf5aeebf86be81cb1facdf9c6c0505dd8070d666d494563eb4e26e

Sharing

Copy URL Twitter E-mail

General

Target

24477ba41ebf5aeebf86be81cb1facdf9c6c0505dd8070d666d494563eb4e26e
Size

223KB
MD5

bf203215a99a7b24f0481003e91ffa65
SHA1

6a3e681075acc26c09d014213d016b9703954531
SHA256

24477ba41ebf5aeebf86be81cb1facdf9c6c0505dd8070d666d494563eb4e26e
SHA512

654c5cd34babc0a4aa4453946bbfbc50c252da97695bbeb7142e8748659d30ed5dd907918dcceeaf00dbdd2ba664cea5c9275564a1771af7f2d91dfd521eb354
SSDEEP

3072:8HyfSIU6o2oWb6xIlXD/4itRcv6krPPxjxL6rw1gxxR8PUCYbKu50H1hs4Ix/jib:KdQOsD/NSLvgRXJ7yYpTBJKRlN

Score

N/A

Malware Config

Signatures

Files

24477ba41ebf5aeebf86be81cb1facdf9c6c0505dd8070d666d494563eb4e26e
.dll windows x86

669657e3b303bd7906e02a3d3b84c380

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

nss3

CERT_CertChainFromCert
PK11_GetSlotFromPrivateKey
PK11_GetInternalSlot
PK11_GetKeyData
CERT_DestroyCertificateList
SECKEY_CreateRSAPrivateKey
SECKEY_DestroyPrivateKey
CERT_DupCertificate
PK11_FreeSymKey
PK11_GetWrapKey
PK11_GetBestWrapMechanism
PK11_SetWrapKey
PK11_GetMechanism
PK11_WrapSymKey
CERT_DestroyCertificate
PK11_VerifyKeyOK
PK11_GetCurrentWrapIndex
PK11_PubDerive
SECKEY_CreateDHPrivateKey
SECKEY_PublicKeyStrengthInBits
PK11_ImportSymKey
PK11_UnwrapSymKeyWithFlags
SECKEY_UpdateCertPQG
CERT_NewTempCertificate
CERT_NameToAscii
CERT_VerifyCertName
CERT_VerifyCertNow
HASH_GetHashObject
__PK11_CreateContextByRawKey
PK11_GetBestSlot
PK11_PubDecryptRaw
PK11_PubEncryptRaw
CERT_FindCertByName
CERT_FindUserCertByUsage
PK11_FindKeyByAnyCert
CERT_GetCertNicknames
CERT_CheckCertValidTimes
CERT_FreeNicknames
CERT_GetDefaultCertDB
CERT_DupDistNames
CERT_DistNamesFromCertList
PK11_ReferenceSlot
PK11_CopyTokenPrivKeyToSessionPrivKey
PK11_MapSignKeyType
SECKEY_CopyPrivateKey
SECKEY_CacheStaticFlags
CERT_DupCertList
CERT_GetSSLCACerts
CERT_FreeDistNames
PK11_Finalize
NSS_RegisterShutdown
NSS_VersionCheck
VFY_CreateContext
VFY_Begin
VFY_Update
VFY_End
VFY_DestroyContext
SGN_NewContext
SGN_Begin
SGN_Update
SGN_End
PK11_ReferenceSymKey
PK11_GetBestKeyLength
PK11_SaveContextAlloc
PK11_DigestKey
PK11_RestoreContext
PK11_CreateDigestContext
PK11_Derive
PK11_GetSlotFromKey
PK11_SymKeyFromHandle
SECMOD_LookupSlot
PK11_IsPresent
PK11_GetSlotSeries
PK11_GetSlotID
PK11_GetModuleID
PK11_NeedLogin
PK11_IsLoggedIn
PK11_DigestBegin
PK11_DigestOp
PK11_DigestFinal
PK11_CreateContextBySymKey
PK11_IVFromParam
PK11_CipherOp
PK11_ParamFromIV
PK11_DestroyContext
PK11_HashBuf
DSAU_DecodeDerSig
PK11_Verify
PK11_SignatureLen
PK11_Sign
DSAU_EncodeDerSigWithLen
PK11_GenerateRandom
PK11_TokenExists
CERT_ExtractPublicKey
SECKEY_GetPrivateKeyType
PK11_GetPrivateModulusLen
PK11_GetBestSlotMultiple
PK11_KeyGen
PK11_FreeSlot
SECKEY_PublicKeyStrength
PK11_PubWrapSymKey
PK11_PrivDecryptPKCS1
PK11_PubUnwrapSymKey
SECKEY_DestroyPublicKey
PK11_DeriveWithFlags
PK11_ExtractKeyValue
SGN_DestroyContext

nssutil3

SECITEM_DupItem_Util
DER_Lengths_Util
NSSRWLock_New_Util
NSSRWLock_Destroy_Util
ATOB_AsciiToData_Util
BTOA_DataToAscii_Util
SECITEM_Hash
SECOID_GetAlgorithmTag_Util
PORT_Realloc_Util
SECITEM_AllocItem_Util
SECITEM_ZfreeItem_Util
NSS_SecureMemcmp
PORT_ArenaAlloc_Util
PORT_NewArena_Util
PORT_ArenaZAlloc_Util
PORT_GetError_Util
PORT_FreeArena_Util
PORT_ZAlloc_Util
SECITEM_CopyItem_Util
PORT_Strdup_Util
SECITEM_CompareItem_Util
NSSRWLock_LockRead_Util
NSSRWLock_UnlockRead_Util
PORT_ZFree_Util
NSSRWLock_LockWrite_Util
NSSRWLock_UnlockWrite_Util
PORT_Free_Util
PORT_Alloc_Util
SECITEM_FreeItem_Util
PORT_SetError_Util
NSS_PutEnv_Util

libplc4

PL_strdup

libnspr4

PR_GetEnv
PR_FindFunctionSymbol
PR_UnloadLibrary
PR_GetLibraryFilePathname
PR_Free
PR_GetDirectorySeparator
PR_LoadLibraryWithFlags
PR_Now
PR_Close
PR_NewMonitor
PR_CreateIOLayerStub
PR_PushIOLayer
PR_GetUniqueIdentity
PR_GetDefaultIOMethods
PR_GetSocketOption
PR_ConvertIPv4AddrToIPv6
PR_SetError
PR_DestroyMonitor
PR_GetIdentitiesLayer
PR_EmulateAcceptRead
PR_EmulateSendFile
PR_ImportFileMapFromString
PR_ExportFileMapAsString
PR_smprintf
PR_OpenAnonFileMap
PR_smprintf_free
PR_MemMap
PR_MemUnmap
PR_CloseFileMap
PR_StringToNetAddr
PR_CallOnceWithArg
PR_CallOnce
PR_ErrorInstallTable
PR_PopIOLayer
PR_GetCurrentThread
PR_ExitMonitor
PR_Sleep
PR_EnterMonitor
PR_GetError
PR_NewLock
PR_Lock
PR_Unlock
PR_DestroyLock

kernel32

VirtualFree
HeapDestroy
HeapCreate
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
InterlockedDecrement
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ExitProcess
GetProcAddress
Sleep
GetModuleHandleW
WideCharToMultiByte
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
HeapFree
HeapAlloc
GetCommandLineA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
WaitForSingleObject
ReleaseMutex
CloseHandle
CreateMutexA
GetLastError
GetTickCount
VirtualAlloc
HeapReAlloc
WriteFile
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
CompareStringA
MultiByteToWideChar
CompareStringW
SetEnvironmentVariableA
LoadLibraryA
InitializeCriticalSectionAndSpinCount
RtlUnwind
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
QueryPerformanceCounter

Exports

Exports

NSSSSL_GetVersion
NSSSSL_VersionCheck
NSS_CmpCertChainWCANames
NSS_FindCertKEAType
NSS_GetClientAuthData
NSS_SetDomesticPolicy
NSS_SetExportPolicy
NSS_SetFrancePolicy
SSL_AuthCertificate
SSL_AuthCertificateComplete
SSL_AuthCertificateHook
SSL_BadCertHook
SSL_CanBypass
SSL_CertDBHandleSet
SSL_CipherPolicyGet
SSL_CipherPolicySet
SSL_CipherPrefGet
SSL_CipherPrefGetDefault
SSL_CipherPrefSet
SSL_CipherPrefSetDefault
SSL_ClearSessionCache
SSL_ConfigMPServerSIDCache
SSL_ConfigSecureServer
SSL_ConfigSecureServerWithCertChain
SSL_ConfigServerSessionIDCache
SSL_ConfigServerSessionIDCacheWithOpt
SSL_DataPending
SSL_ForceHandshake
SSL_ForceHandshakeWithTimeout
SSL_GetChannelInfo
SSL_GetCipherSuiteInfo
SSL_GetClientAuthDataHook
SSL_GetImplementedCiphers
SSL_GetMaxServerCacheLocks
SSL_GetNegotiatedHostInfo
SSL_GetNextProto
SSL_GetNumImplementedCiphers
SSL_GetSessionID
SSL_GetStatistics
SSL_HandshakeCallback
SSL_HandshakeNegotiatedExtension
SSL_ImplementedCiphers
SSL_ImportFD
SSL_InheritMPServerSIDCache
SSL_InvalidateSession
SSL_LocalCertificate
SSL_NumImplementedCiphers
SSL_OptionGet
SSL_OptionGetDefault
SSL_OptionSet
SSL_OptionSetDefault
SSL_PeerCertificate
SSL_PreencryptedFileToStream
SSL_PreencryptedStreamToFile
SSL_ReHandshake
SSL_ReHandshakeWithTimeout
SSL_ReconfigFD
SSL_ResetHandshake
SSL_RestartHandshakeAfterCertReq
SSL_RestartHandshakeAfterServerCert
SSL_RevealCert
SSL_RevealPinArg
SSL_RevealURL
SSL_SNISocketConfigHook
SSL_SecurityStatus
SSL_SetMaxServerCacheLocks
SSL_SetNextProtoCallback
SSL_SetNextProtoNego
SSL_SetPKCS11PinArg
SSL_SetSockPeerID
SSL_SetTrustAnchors
SSL_SetURL
SSL_ShutdownServerSessionIDCache

Sections

.text
Size: 159KB - Virtual size: 159KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 760B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

669657e3b303bd7906e02a3d3b84c380

Headers

DLL Characteristics

File Characteristics

Imports

nss3

nssutil3

libplc4

libnspr4

kernel32

Exports

Exports

Sections

.text Size: 159KB - Virtual size: 159KB

.rdata Size: 47KB - Virtual size: 47KB

.data Size: 4KB - Virtual size: 7KB

.rsrc Size: 1024B - Virtual size: 760B

.reloc Size: 10KB - Virtual size: 9KB

.text
Size: 159KB - Virtual size: 159KB

.rdata
Size: 47KB - Virtual size: 47KB

.data
Size: 4KB - Virtual size: 7KB

.rsrc
Size: 1024B - Virtual size: 760B

.reloc
Size: 10KB - Virtual size: 9KB