405d1cf3649a1af83f28d8f0e5134f3d4d2d43bae219413772e0465b15e09c77

Sharing

Copy URL

Twitter E-mail

General

Target

405d1cf3649a1af83f28d8f0e5134f3d4d2d43bae219413772e0465b15e09c77
Size

240KB
MD5

4c8f3b915819257184e8cd437ddb5830
SHA1

be9fed427871591af5d4fb703f4dc68d68864780
SHA256

405d1cf3649a1af83f28d8f0e5134f3d4d2d43bae219413772e0465b15e09c77
SHA512

6f99f48a44a6a8483fe6670d407368b54667809d28d9da33e1186f856dbf3cb5066e7543958258c2522151f639bf311757a92582000754ee49f3233b5ff9bae0
SSDEEP

3072:IeeQRX9wmYISzSSGhFh/+/IxDVZkfefj/Zab6XBdmOivQTPxyAnIP3fa9cX+rmdt:lRXe9KXWe0oj/cbszmnGtni7+r8kGND

Score

N/A

Malware Config

Signatures

Files

405d1cf3649a1af83f28d8f0e5134f3d4d2d43bae219413772e0465b15e09c77
.exe windows x86

e3d3a6582617d84c4b73888755e84047

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ipsecsnp

DllGetClassObject
DllUnregisterServer
DllRegisterServer
DllCanUnloadNow

msvcrt

__p___initenv
exit
__getmainargs
_except_handler3
_ftime64
_yn
_acmdln
iscntrl
_initterm
_controlfp
__p__commode
__p__fmode
__set_app_type
_cexit
_mbsnbcnt
_adjust_fdiv
_XcptFilter
_exit
__setusermatherr

iasads

DllUnregisterServer
DllCanUnloadNow
DllRegisterServer
DllGetClassObject

crypt32

CertEnumCertificateContextProperties
CertStrToNameA
CertIsRDNAttrsInCertificateName
CertFindCRLInStore
RegCreateHKCUKeyExU
CryptUninstallDefaultContext
CryptGetDefaultOIDDllList
CryptVerifySignatureU
CertEnumSubjectInSortedCTL
CertVerifyCRLRevocation
CertGetCRLFromStore
CertGetNameStringW
CryptCloseAsyncHandle
CryptSignMessageWithKey

xolehlp

DtcGetTransactionManagerEx
DtcGetTransactionManager
DtcGetTransactionManagerExA
DtcGetTransactionManagerC
DtcGetTransactionManagerExW
GetDtcLocaleResourceHandle

d3dxof

DirectXFileCreate
DllCanUnloadNow
DllGetClassObject

urlmon

DllInstall
CoInternetCombineUrl
CoInternetParseUrl
GetMarkOfTheWeb
AsyncGetClassBits
BindAsyncMoniker
DllGetClassObject
URLOpenStreamW
URLOpenBlockingStreamA
CreateURLMoniker
URLOpenPullStreamA
CoGetClassObjectFromURL
CoInternetGetProtocolFlags
DllRegisterServerEx
RevokeFormatEnumerator

dbnmpntw

ConnectionOpenW
ConnectionRead
ConnectionErrorW
ConnectionError
ConnectionCheckForData
ConnectionWriteOOB
ConnectionClose
ConnectionServerEnum
ConnectionWrite
ConnectionServerEnumW
ConnectionObjectSize
ConnectionOpen
ConnectionMode
ConnectionTransact
ConnectionVer
ConnectionStatus

ntshrui

IsPathSharedW
GetNetResourceFromLocalPathA
GetLocalPathFromNetResource
DllCanUnloadNow
GetLocalPathFromNetResourceW
IsPathSharedA
GetLocalPathFromNetResourceA
IsPathShared
GetNetResourceFromLocalPathW
DllGetClassObject
GetNetResourceFromLocalPath

ddraw

DllCanUnloadNow
DSoundHelp
AcquireDDThreadLock
CompleteCreateSysmemSurface
DirectDrawEnumerateExW
GetOLEThunkData
DirectDrawEnumerateW
DirectDrawCreateClipper
DirectDrawEnumerateA
RegisterSpecialCase
DirectDrawCreate
GetDDSurfaceLocal
DDInternalLock
DllGetClassObject

pid

DllGetClassObject
DllCanUnloadNow

kernel32

VirtualAlloc
GetStartupInfoA
GetModuleHandleA

cfgmgr32

CM_Disable_DevNode
CM_Enumerate_Enumerators_ExW
CM_Free_Range_List
CM_Get_Class_Name_ExW
CM_First_Range
CM_Create_DevNode_ExA
CM_Get_Device_ID_Size_Ex
CM_Get_HW_Prof_FlagsA
CM_Enable_DevNode
CM_Query_And_Remove_SubTreeA
CM_Get_Device_ID_List_Size_ExW
CM_Get_Device_ID_List_SizeA
CM_Get_Device_Interface_Alias_ExA
CM_Remove_SubTree_Ex
CM_Get_Res_Des_Data_Size

msdmo

MoDuplicateMediaType
DMOGuidToStrA
DMOStrToGuidA
MoDeleteMediaType
DMOStrToGuidW
DMOGetName
DMOUnregister
DMORegister
DMOEnum
MoCreateMediaType
MoCopyMediaType
DMOGuidToStrW
DMOGetTypes
MoFreeMediaType
MoInitMediaType

wmi

WmiSetSingleItemA
WmiQuerySingleInstanceA
TraceEventInstance
WmiDevInstToInstanceNameA
WmiNotificationRegistrationA
QueryAllTracesW
UnregisterTraceGuids
GetTraceEnableFlags
WmiQueryAllDataA
GetTraceEnableLevel
WmiSetSingleItemW
OpenTraceW
WmiQueryGuidInformation
WmiExecuteMethodW
OpenTraceA
QueryAllTracesA
WmiCloseBlock
StartTraceA
CreateTraceInstanceId
WmiSetSingleInstanceA
CloseTrace

fmifs

SetLabel
EnableVolumeCompression
FormatEx2
QueryLatestFileSystemVersion
Format
ChkdskEx
QueryAvailableFileSystemFormat
Extend
FormatEx
ComputeFmMediaType

newdev

InstallWindowsUpdateDriver
InstallSelectedDriver
UpdateDriverForPlugAndPlayDevicesA
InstallNewDevice
UpdateDriverForPlugAndPlayDevicesW

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 29KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 215KB - Virtual size: 242KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 204B

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e3d3a6582617d84c4b73888755e84047

Headers

DLL Characteristics

File Characteristics

Imports

ipsecsnp

msvcrt

iasads

crypt32

xolehlp

d3dxof

urlmon

dbnmpntw

ntshrui

ddraw

pid

kernel32

cfgmgr32

msdmo

wmi

fmifs

newdev

Sections

.text Size: 2KB - Virtual size: 2KB

.rdata Size: 21KB - Virtual size: 29KB

.data Size: 215KB - Virtual size: 242KB

.reloc Size: 512B - Virtual size: 204B

.text
Size: 2KB - Virtual size: 2KB

.rdata
Size: 21KB - Virtual size: 29KB

.data
Size: 215KB - Virtual size: 242KB

.reloc
Size: 512B - Virtual size: 204B