749ab2aa4fb1e3cecb294cb22092d99200751f11c3775e8c4f297ef8623c1abf

Sharing

Copy URL

Twitter E-mail

General

Target

749ab2aa4fb1e3cecb294cb22092d99200751f11c3775e8c4f297ef8623c1abf
Size

156KB
MD5

ba0b49436d2932ea098cd65cf80a15e0
SHA1

587e5433ca8e75261a0397e7b17c976e54920595
SHA256

749ab2aa4fb1e3cecb294cb22092d99200751f11c3775e8c4f297ef8623c1abf
SHA512

842aa4bd7e597b5e5a983a3427098b65b41bf8bf5626d12b958757b6ae9ee5230bb142d1cbe89185cab08af9efd8ae0573a9d065f4c1f622c01d78eda7ed5a76
SSDEEP

3072:wogNjbHDAJjq9wrvu+/+ODypUwjWhRxtuyiKYXpRYXHPdt5iJicTuaSWe646:wfwjbrOODiktU1XpaXHP75iJiWuF2

Score

N/A

Malware Config

Signatures

Files

749ab2aa4fb1e3cecb294cb22092d99200751f11c3775e8c4f297ef8623c1abf
.dll windows x86

815c29d7c3a7faa8e6e567f05069c30c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

common

??1_HashTableRep@pcd@@QAE@XZ
??1Serializable@pcd@@UAE@XZ
??0_HashTableRep@pcd@@QAE@ABV01@@Z
??0Serializable@pcd@@QAE@ABV01@@Z
?doSerialization@Serializable@pcd@@UAEXABVString@2@AAV32@@Z
?deserialize@Serializable@pcd@@UAEXABVString@2@@Z
?deserializeUtf8@Serializable@pcd@@UAEXPBD@Z
?serializeBegin@Serializable@pcd@@MAEXABVString@2@@Z
?serializeEnd@Serializable@pcd@@MAEXXZ
?getSerializedXML@Serializable@pcd@@MAEXAAVString@2@@Z
?deserializeBegin@Serializable@pcd@@MAEXPBVXmlElement@2@@Z
?deserializeEnd@Serializable@pcd@@MAEXXZ
?insertValueToContainer@Serializable@pcd@@MAEXHPBVXmlElement@2@AAVString@2@@Z
??4_HashTableRep@pcd@@QAEAAV01@ABV01@@Z
??4Serializable@pcd@@QAEAAV01@ABV01@@Z
?createLogger@LogFactory@pcd@@SAXPBDAAPAVLogger@2@@Z
?getPriority@LogFactory@pcd@@SA?AW4LOGGER_PRIORITY@LoggerPriority@2@XZ
??1String@pcd@@QAE@XZ
??1LoggerStream@pcd@@QAE@XZ
?log@Logger@pcd@@QAE_NW4LOGGER_PRIORITY@LoggerPriority@2@ABVLoggerStream@2@@Z
?append@String@pcd@@QAEAAV12@ABV12@@Z
?append@String@pcd@@QAEAAV12@PBD@Z
??0LoggerStream@pcd@@QAE@XZ
?SprintfFormat@pcd@@YA?AVString@1@PBDZZ
?getLocalizedResource@LocalizedResource@pcd@@SAAAV12@ABVString@2@0ABVPCDLocale@2@0@Z
?P5P_EXTENSION@LocalizedResource@pcd@@SAABVString@2@XZ
?getGlobalLocale@PCDLocale@pcd@@SAABV12@XZ
?getDefaultPath@LocalizedResource@pcd@@SAABVString@2@XZ
??0String@pcd@@QAE@PBD@Z
?clear@_HashTableRep@pcd@@QAEXXZ
??0_HashTableIteratorBase@pcd@@QAE@PAPAV_BucketBase@1@0@Z
??1_BucketBase@pcd@@UAE@XZ
??_7_BucketBase@pcd@@6B@
??1PCDValue@pcd@@UAE@XZ
??0NullPointer@pcd@@QAE@ABVString@1@@Z
??Hpcd@@YA?AVString@0@PBDABV10@@Z
?toString@PCDValue@pcd@@QBE?AVString@2@I@Z
?nilValue@PCDValue@pcd@@SAIXZ
??0PCDValue@pcd@@QAE@I@Z
??1NullPointer@pcd@@UAE@XZ
??0NullPointer@pcd@@QAE@ABV01@@Z
??0Exception@pcd@@QAE@ABV01@@Z
??0String@pcd@@QAE@ABV01@@Z
?getString@LocalizedResource@pcd@@QAE_NABVString@2@AAV32@_N@Z
??0String@pcd@@QAE@XZ
??YString@pcd@@QAEAAV01@ABV01@@Z
??HString@pcd@@QBE?AV01@ABV01@@Z
??0PCDValue@pcd@@QAE@E@Z
?insertWithoutCheck@_HashTableRep@pcd@@QAEXIPAV_BucketBase@2@PBX@Z
??0Serializable@pcd@@QAE@XZ
??0SerializationFailed@pcd@@QAE@ABVString@1@@Z
??1SerializationFailed@pcd@@UAE@XZ
??0SerializationFailed@pcd@@QAE@ABV01@@Z
??0IndexOutOfBounds@pcd@@QAE@HHH@Z
??1IndexOutOfBounds@pcd@@UAE@XZ
??0IndexOutOfBounds@pcd@@QAE@ABV01@@Z
??1?$Array@E@pcd@@UAE@XZ
??A?$Array@E@pcd@@QAEAAEI@Z
?size@?$Array@E@pcd@@QBEIXZ
?deserialize@Serializable@pcd@@IAEXPBDAAV12@@Z
??0?$Array@E@pcd@@QAE@XZ
??1?$Array@G@pcd@@UAE@XZ
??A?$Array@G@pcd@@QAEAAGI@Z
?size@?$Array@G@pcd@@QBEIXZ
??0?$Array@G@pcd@@QAE@XZ
?className@?$Array@E@pcd@@SAPBDXZ
?className@?$Array@G@pcd@@SAPBDXZ
?serialize@Serializable@pcd@@IAEXPBDAAV12@@Z
??E_HashTableIteratorBase@pcd@@QAEAAV01@XZ
?append@?$Array@E@pcd@@QAEXABE@Z
?append@?$Array@G@pcd@@QAEXABG@Z
?strnlen@String@pcd@@SAIPBDI@Z
??0AssertionFailure@pcd@@QAE@PBDI0@Z
??1AssertionFailure@pcd@@UAE@XZ
??0AssertionFailure@pcd@@QAE@ABV01@@Z
??0Mutex@pcd@@QAE@XZ
?insert@_HashTableRep@pcd@@QAE_NIPAV_BucketBase@2@PBX@Z
??1AutoMutex@pcd@@QAE@XZ
??0AutoMutex@pcd@@QAE@PAVMutex@1@@Z
?lookup@_HashTableRep@pcd@@QBEPBV_BucketBase@2@IPBX@Z
??E_HashTableIteratorBase@pcd@@QAE?AV01@H@Z
??_DOFStream@pcd@@QAEXXZ
??1Stream@pcd@@UAE@XZ
??1OStream@pcd@@UAE@XZ
??1OFStream@pcd@@UAE@XZ
?close@Stream@pcd@@QAE_NXZ
?write@OFStream@pcd@@UAE_NPBXH@Z
?openFile@OFStream@pcd@@QAE_NABVString@2@ABW4FileMode@2@@Z
??0OFStream@pcd@@QAE@XZ
??0_HashTableRep@pcd@@QAE@I@Z
?userIsAdministrator@System@pcd@@SA_NXZ

kernelmode

??_7MemDriver@libKernelMode@@6B@
??1Driver@libKernelMode@@UAE@XZ
??1MemDriver@libKernelMode@@UAE@XZ
?readPhysicalMemory@MemDriver@libKernelMode@@QBE_N_KPAEI@Z
??0Driver@libKernelMode@@QAE@XZ
?openDriver@Driver@libKernelMode@@QAE_NXZ

msvcr80

_onexit
_decode_pointer
_malloc_crt
free
_lock
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
__clean_type_info_names_internal
_encode_pointer
__dllonexit
_unlock
_errno
sprintf
_purecall
memcpy
memset
??_V@YAXPAX@Z
printf
_CxxThrowException
??2@YAPAXI@Z
??3@YAXPAX@Z
__CxxFrameHandler3
_encoded_null

kernel32

InterlockedExchange
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
Sleep

Exports

Exports

??0Smbios2@libsmbios2_internal@@QAE@ABV01@@Z
??0Smbios2@libsmbios2_internal@@QAE@XZ
??1Smbios2@libsmbios2_internal@@QAE@XZ
??4Smbios2@libsmbios2_internal@@QAEAAV01@ABV01@@Z
??4Smbios2_SysInfo@libsmbios2@@QAEAAV01@ABV01@@Z
?__findEP@Smbios2@libsmbios2_internal@@IAEHXZ
?__flush_memory@Smbios2@libsmbios2_internal@@IAEXXZ
?__setVersionString@Smbios2@libsmbios2_internal@@IAEHXZ
?closeHandle@Smbios2@libsmbios2_internal@@IAEHXZ
?findStructure@Smbios2@libsmbios2_internal@@QBEHGPAPBX@Z
?getEP@Smbios2@libsmbios2_internal@@QBEPBUsmbios_entrypoint@@XZ
?getEnumFieldString@Smbios2_SysInfo@libsmbios2@@SAPBDABEABI1EE@Z
?getLocalizedEnumFieldString@Smbios2_SysInfo@libsmbios2@@SA?BVString@pcd@@ABEABI1EE@Z
?getMaxSupportedMemory@Smbios2_SysInfo@libsmbios2@@SA_KH@Z
?getMemSlotInfo@Smbios2_SysInfo@libsmbios2@@SA_NAAI0@Z
?getMemoryDeviceHandle@Smbios2_SysInfo@libsmbios2@@SAGI@Z
?getPCIDevEntry@Smbios2_SysInfo@libsmbios2@@SAPBUt9@@E@Z
?getPCISlotID@Smbios2_SysInfo@libsmbios2@@SAHPBUt9@@@Z
?getString@Smbios2@libsmbios2_internal@@QBEPBDPBUtype_hdr@@E@Z
?getString@Smbios2_SysInfo@libsmbios2@@SAPBDPBUtype_hdr@@E@Z
?getTablePtr@Smbios2@libsmbios2_internal@@QBEPBEXZ
?getTotalDimmSize@Smbios2_SysInfo@libsmbios2@@SA_KXZ
?getVersion@Smbios2@libsmbios2_internal@@QBEIXZ
?getVersionMask@Smbios2@libsmbios2_internal@@QBEIXZ
?getVersionString@Smbios2@libsmbios2_internal@@QBEPBDXZ
?isDefinedEnum@Smbios2_SysInfo@libsmbios2@@SA_NPBD@Z
?isKnownEnum@Smbios2_SysInfo@libsmbios2@@SA_NPBD@Z
?isPresent@Smbios2@libsmbios2_internal@@QAEHXZ
?localize@Smbios2_SysInfo@libsmbios2@@CAAAVLocalizedResource@pcd@@XZ
?memoryStructCallback@Smbios2_SysInfo@libsmbios2@@SA_NHP6A_NPBUt16@@PBUt17@@PAX@Z2@Z
?openHandle@Smbios2@libsmbios2_internal@@IAEHXZ
?populateTable@Smbios2@libsmbios2_internal@@QAE?AW4POPULATE_TABLE_RESULT@12@_N@Z
?readStructure@Smbios2@libsmbios2_internal@@QBEHEPAPBXI@Z
?saveTableToFile@Smbios2@libsmbios2_internal@@QAE_NABVString@pcd@@@Z
?structureCount@Smbios2@libsmbios2_internal@@QBEHE@Z

Sections

.text
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 428B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 62KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

815c29d7c3a7faa8e6e567f05069c30c

Headers

File Characteristics

Imports

common

kernelmode

msvcr80

kernel32

Exports

Exports

Sections

.text Size: 40KB - Virtual size: 40KB

.rdata Size: 26KB - Virtual size: 26KB

.data Size: 14KB - Virtual size: 15KB

.rsrc Size: 512B - Virtual size: 428B

.reloc Size: 11KB - Virtual size: 10KB

.text Size: 62KB - Virtual size: 64KB

.text
Size: 40KB - Virtual size: 40KB

.rdata
Size: 26KB - Virtual size: 26KB

.data
Size: 14KB - Virtual size: 15KB

.rsrc
Size: 512B - Virtual size: 428B

.reloc
Size: 11KB - Virtual size: 10KB

.text
Size: 62KB - Virtual size: 64KB