b0f01fc919c0a645ea9129ac2b6072c253f14892f1ed180af2b3dc900fb4d452

Sharing

Copy URL Twitter E-mail

General

Target

b0f01fc919c0a645ea9129ac2b6072c253f14892f1ed180af2b3dc900fb4d452
Size

394KB
MD5

cfe9cefda5371881df91a02f0774d8fd
SHA1

8416d5b8382f0b64a7c5ab5f79ffdffa6efe4f67
SHA256

b0f01fc919c0a645ea9129ac2b6072c253f14892f1ed180af2b3dc900fb4d452
SHA512

b01ebc1b32753916cf9084ee61bc4ada2f67ec309d2047fedbf1974a4a7790af139d9e4fb33deaaa012c1e1aed556eabde0441adf08e17b0ab42d7bb379c70ec
SSDEEP

12288:n4gptf2PTF7kR7YNQDk7SPCy6HwVQ0gd9Pa:4Yx2bF+YND7+CHwVxy1

Score

N/A

Malware Config

Signatures

Files

b0f01fc919c0a645ea9129ac2b6072c253f14892f1ed180af2b3dc900fb4d452
.dll windows x86

a66a6fadb739f0ae999747f7576cb123

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegConnectRegistryW
QueryServiceStatus
FreeSid
AllocateAndInitializeSid
CheckTokenMembership
RegOpenKeyW
RegEnumKeyExW
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
OpenSCManagerW
OpenServiceW
CloseServiceHandle
ControlService
OpenProcessToken
GetTokenInformation
RegEnumKeyW
RegDeleteKeyW
RegQueryInfoKeyW
RegEnumValueW
RegDeleteValueW
RegOpenKeyExW
RegCreateKeyExW
RegQueryValueExW
RegCloseKey
RegSetValueExW
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
GetSidSubAuthority
OpenThreadToken
GetSidLengthRequired
InitializeSid
SetSecurityDescriptorDacl

kernel32

InterlockedDecrement
InterlockedIncrement
GetVersionExW
CreateDirectoryW
ExpandEnvironmentStringsW
GetSystemWindowsDirectoryW
GetCurrentThread
OpenMutexA
CreateMutexA
ReleaseMutex
CreateFileW
GetFullPathNameW
GlobalSize
HeapAlloc
HeapReAlloc
HeapFree
FreeLibrary
GetProcAddress
GetLastError
LoadLibraryW
GlobalAlloc
GlobalFree
lstrcpynW
FormatMessageW
FormatMessageA
LocalFree
LocalAlloc
LeaveCriticalSection
EnterCriticalSection
lstrcmpiW
lstrlenW
PostQueuedCompletionStatus
GetQueuedCompletionStatus
SetEvent
CloseHandle
CreateThread
WaitForSingleObject
CreateIoCompletionPort
CreateEventW
DelayLoadFailureHook
InitializeCriticalSection
DisableThreadLibraryCalls
GetCurrentProcess
lstrcmpW
ResetEvent
lstrcpyA
Sleep
GetFileAttributesW
lstrcpynA
GlobalReAlloc
lstrlenA
CreateFileA
MoveFileA
DeleteFileA
ReadFile
WriteFile
lstrcatA
WideCharToMultiByte
MultiByteToWideChar
GetModuleHandleW
lstrcpyW
GetSystemDirectoryW
CompareStringW
GetCommandLineW
FindClose
FindNextFileW
FindFirstFileW
InterlockedCompareExchange
LoadLibraryA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
OpenEventA
lstrcatW
DeleteCriticalSection
GetCommandLineA
InterlockedExchange
SetEndOfFile
SetFilePointer
ExpandEnvironmentStringsA
WaitForMultipleObjects
CreateEventA
lstrcmpiA
lstrcmpA
IsDBCSLeadByte

msvcrt

wcsncmp
wcslen
wcscpy
strncpy
_wcslwr
_ltoa
qsort
wcsstr
_wcsnicmp
_wtol
_itow
_except_handler3
_snwprintf
_ultow
atol
_strlwr
strncat
_strnicmp
_wcsicmp
strchr
_mbscspn
strrchr
_stricmp
wcscat
_ltow
wcsncpy
wcsncat
wcstoul
strstr
_adjust_fdiv
malloc
_initterm
free
memmove

ntdll

RtlOpenCurrentUser
NtClose
RtlFreeUnicodeString
RtlNtStatusToDosError
RtlAnsiStringToUnicodeString
RtlInitUnicodeString
RtlInitAnsiString
NtQueryValueKey
NtOpenKey
NtSetValueKey
DbgPrint

rasman

RasRpcGetInstalledProtocols
RasRpcGetInstalledProtocolsEx
RasRpcSetUserPreferences
RasGetDeviceNameW
RasSendNotification
RasIsTrustedCustomDll
RasSetCommSettings
RasGetCustomScriptDll
RasRpcGetUserPreferences
RasGetUnicodeDeviceName
RasSetKey
RasGetKey
RasGetPortUserData
RasDoIke
DwRasGetHostByName
RasSetAddressDisable
RasSetPortUserData
RasPortDisconnect
RasmanUninitialize
RasRefreshKerbCreds
RasSendCreds

rpcrt4

I_RpcExceptionFilter
UuidCreate

tapi32

lineGetTranslateCapsW
lineGetCountryW
lineTranslateAddressW

user32

CharNextW
CharPrevW
wsprintfW
SendMessageW
OemToCharBuffA
RegisterWindowMessageA
SendMessageA
SendNotifyMessageA
wsprintfA
CharNextA
IsCharAlphaNumericA
IsCharAlphaA
LoadStringA

Exports

Exports

DDMGetPhonebookInfo
DwCloneEntry
DwDeleteSubEntry
DwEnumEntriesForAllUsers
DwEnumEntryDetails
DwRasRefreshKerbScCreds
DwRasUninitialize
RasAutoDialSharedConnection
RasAutodialAddressToNetwork
RasAutodialEntryToNetwork
RasClearConnectionStatistics
RasClearLinkStatistics
RasConnectionNotificationA
RasConnectionNotificationW
RasCreatePhonebookEntryA
RasCreatePhonebookEntryW
RasDeleteEntryA
RasDeleteEntryW
RasDeleteSubEntryA
RasDeleteSubEntryW
RasDialA
RasDialW
RasDialWow
RasEditPhonebookEntryA
RasEditPhonebookEntryW
RasEnumAutodialAddressesA
RasEnumAutodialAddressesW
RasEnumConnectionsA
RasEnumConnectionsW
RasEnumConnectionsWow
RasEnumDevicesA
RasEnumDevicesW
RasEnumEntriesA
RasEnumEntriesW
RasEnumEntriesWow
RasFreeEapUserIdentityA
RasFreeEapUserIdentityW
RasGetAutodialAddressA
RasGetAutodialAddressW
RasGetAutodialEnableA
RasGetAutodialEnableW
RasGetAutodialParamA
RasGetAutodialParamW
RasGetConnectResponse
RasGetConnectStatusA
RasGetConnectStatusW
RasGetConnectStatusWow
RasGetConnectionStatistics
RasGetCountryInfoA
RasGetCountryInfoW
RasGetCredentialsA
RasGetCredentialsW
RasGetCustomAuthDataA
RasGetCustomAuthDataW
RasGetEapUserDataA
RasGetEapUserDataW
RasGetEapUserIdentityA
RasGetEapUserIdentityW
RasGetEntryDialParamsA
RasGetEntryDialParamsW
RasGetEntryHrasconnA
RasGetEntryHrasconnW
RasGetEntryPropertiesA
RasGetEntryPropertiesW
RasGetErrorStringA
RasGetErrorStringW
RasGetErrorStringWow
RasGetHport
RasGetLinkStatistics
RasGetNapStatus
RasGetProjectionInfoA
RasGetProjectionInfoW
RasGetSubEntryHandleA
RasGetSubEntryHandleW
RasGetSubEntryPropertiesA
RasGetSubEntryPropertiesW
RasHangUpA
RasHangUpW
RasHangUpWow
RasInvokeEapUI
RasIsRouterConnection
RasIsSharedConnection
RasQueryRedialOnLinkFailure
RasQuerySharedAutoDial
RasQuerySharedConnection
RasRenameEntryA
RasRenameEntryW
RasScriptExecute
RasScriptGetEventCode
RasScriptGetIpAddress
RasScriptInit
RasScriptReceive
RasScriptSend
RasScriptTerm
RasSetAutodialAddressA
RasSetAutodialAddressW
RasSetAutodialEnableA
RasSetAutodialEnableW
RasSetAutodialParamA
RasSetAutodialParamW
RasSetCredentialsA
RasSetCredentialsW
RasSetCustomAuthDataA
RasSetCustomAuthDataW
RasSetEapUserDataA
RasSetEapUserDataW
RasSetEntryDialParamsA
RasSetEntryDialParamsW
RasSetEntryPropertiesA
RasSetEntryPropertiesW
RasSetOldPassword
RasSetSharedAutoDial
RasSetSubEntryPropertiesA
RasSetSubEntryPropertiesW
RasValidateEntryNameA
RasValidateEntryNameW
RasfileClose
RasfileDeleteLine
RasfileFindFirstLine
RasfileFindLastLine
RasfileFindMarkedLine
RasfileFindNextKeyLine
RasfileFindNextLine
RasfileFindPrevLine
RasfileFindSectionLine
RasfileGetKeyValueFields
RasfileGetLine
RasfileGetLineMark
RasfileGetLineText
RasfileGetLineType
RasfileGetSectionName
RasfileInsertLine
RasfileLoad
RasfileLoadInfo
RasfilePutKeyValueFields
RasfilePutLineMark
RasfilePutLineText
RasfilePutSectionName
RasfileWrite
SharedAccessResponseListToString
SharedAccessResponseStringToList
UnInitializeRAS

Sections

.text
Size: 215KB - Virtual size: 214KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 165KB - Virtual size: 167KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a66a6fadb739f0ae999747f7576cb123

Headers

File Characteristics

Imports

advapi32

kernel32

msvcrt

ntdll

rasman

rpcrt4

tapi32

user32

Exports

Exports

Sections

.text Size: 215KB - Virtual size: 214KB

.data Size: 165KB - Virtual size: 167KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 11KB - Virtual size: 10KB

.text
Size: 215KB - Virtual size: 214KB

.data
Size: 165KB - Virtual size: 167KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 11KB - Virtual size: 10KB