eed8cc4c72d6652dab41557afaaf12314330f1e4dcd617cf27365bfcf08ad12a

Sharing

Copy URL Twitter E-mail

General

Target

eed8cc4c72d6652dab41557afaaf12314330f1e4dcd617cf27365bfcf08ad12a
Size

708KB
MD5

1bff4507a6dbc79bfe4c0a2c300f5ea2
SHA1

b888d4d740dfd52516640b0d8bead2adc8ed1156
SHA256

eed8cc4c72d6652dab41557afaaf12314330f1e4dcd617cf27365bfcf08ad12a
SHA512

58618a4a3f72758dfa0f5eb750a73553e0de5e18ae478d58ccf5f0f9d226f52fe4b01f1c4c68c38ba3b99c31da8ecb5ec4e5efebe5385a0a74556f4d0827e7d2
SSDEEP

12288:EVfuFx2lJfSkd7VhEIsyr/FiMnoK3vKTK0Zwi8XEi1XR+3GQzMG3b0:AfukJfSkd7VhEIsyr/FiMnx3vKTBW3Bv

Score

N/A

Malware Config

Signatures

Files

eed8cc4c72d6652dab41557afaaf12314330f1e4dcd617cf27365bfcf08ad12a
.exe windows x86

eec802bf725bd48658aedd496eecae7c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SystemTimeToFileTime
GetSystemTimeAsFileTime
TerminateProcess
GetSystemDefaultLCID
GetFileAttributesExA
GetLocalTime
CompareFileTime
CreateIoCompletionPort
GetQueuedCompletionStatus
GetThreadTimes
GetProcessTimes
CreateDirectoryExA
SetFileAttributesA
GetCurrentProcessId
GetFileAttributesA
DeleteCriticalSection
GetTempFileNameA
GetTickCount
MoveFileA
InitializeCriticalSection
CreateMutexA
ReleaseMutex
LoadLibraryExA
CreateFileA
RemoveDirectoryA
CopyFileA
GetSystemDirectoryA
GetFileTime
GetTempPathA
GetWindowsDirectoryA
FormatMessageA
DeleteFileA
GetCurrentThreadId
CreateProcessA
GetExitCodeProcess
FindFirstFileA
GetShortPathNameA
GetSystemTime
CreateDirectoryA
FindNextFileA
FindClose
LeaveCriticalSection
WaitForSingleObject
EnterCriticalSection
GetCurrentProcess
LocalAlloc
LocalFree
VirtualQueryEx
OpenProcess
GetSystemInfo
HeapAlloc
ReadProcessMemory
GetProcessHeap
GetVersionExA
SetLastError
HeapFree
WritePrivateProfileStringA
GetModuleFileNameA
GetPrivateProfileStringA
CreateThread
GetPrivateProfileIntA
GetComputerNameA
GetExitCodeThread
GetLastError
Sleep
ExitThread
CloseHandle
TerminateThread
FreeLibrary
LoadLibraryA
GetProcAddress
lstrlenA
ReadFile
GlobalFree
SetEnvironmentVariableA
SetStdHandle
GetOEMCP
GetEnvironmentStringsW
CompareStringW
CompareStringA
GetACP
GetFileType
GetTimeZoneInformation
RtlUnwind
InterlockedDecrement
InterlockedIncrement
HeapReAlloc
HeapSize
WideCharToMultiByte
GetCommandLineA
GetVersion
ExitProcess
GetModuleHandleA
GetEnvironmentVariableA
HeapDestroy
GlobalAlloc
HeapCreate
VirtualFree
VirtualAlloc
SetEndOfFile
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
WriteFile
SetHandleCount
GetStdHandle
TlsGetValue
GetStartupInfoA
TlsSetValue
TlsAlloc
LCMapStringW
SetFilePointer
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
LCMapStringA
GetCPInfo
FlushFileBuffers

user32

CloseDesktop
GetUserObjectInformationA
OpenDesktopA
CloseWindowStation
OpenWindowStationA
SetUserObjectSecurity
GetUserObjectSecurity
SetProcessWindowStation

winspool.drv

GetPrinterDataA
SetPrinterDataA
FindNextPrinterChangeNotification
WritePrinter
FreePrinterNotifyInfo
ClosePrinter
GetPrintProcessorDirectoryA
FindFirstPrinterChangeNotification
OpenPrinterA
FindClosePrinterChangeNotification
GetPrinterDriverDirectoryA
DeviceCapabilitiesA
GetPrinterA
EnumPrintersA
EnumPrintProcessorDatatypesA
EnumPrintProcessorsA
EnumPrinterDriversA
EnumMonitorsA
EnumPortsA
DeletePrinterDriverA
AddMonitorA
DeletePrinter
SetPrinterA
AddPrinterDriverA
GetJobA
AddPrinterA
SetJobA
EnumJobsA
EndDocPrinter
StartDocPrinterA
AbortPrinter
EndPagePrinter
StartPagePrinter
AddPrintProcessorA

advapi32

GetExplicitEntriesFromAclA
LookupPrivilegeValueA
OpenProcessToken
GetTokenInformation
IsValidSid
GetSidIdentifierAuthority
AdjustTokenPrivileges
GetSidSubAuthority
RegEnumKeyA
GetSidSubAuthorityCount
RegDeleteValueA
RegDeleteKeyA
RegEnumValueA
RegCreateKeyA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegOpenKeyA
FreeSid
EqualSid
AllocateAndInitializeSid
LookupAccountNameA
CopySid
LookupAccountSidA
LogonUserA
AllocateLocallyUniqueId
GetLengthSid
AddAce
GetAce
SetSecurityDescriptorDacl
GetAclInformation
GetSecurityDescriptorDacl
InitializeAcl
AddAccessAllowedAce
RegQueryValueExW
InitializeSecurityDescriptor
ReadEventLogA
OpenEventLogA
CloseEventLog
ReportEventA
RegisterEventSourceA
GetSecurityInfo
SetSecurityInfo
GetCurrentHwProfileA
QueryServiceStatus
CloseServiceHandle
DeleteAce
OpenSCManagerA
ControlService
OpenServiceA
StartServiceCtrlDispatcherA
RegSaveKeyA
StartServiceA
RegisterServiceCtrlHandlerA
SetServiceStatus
RegCreateKeyExA
DeleteService
RevertToSelf
CreateServiceA
ImpersonateLoggedOnUser
CreateProcessAsUserA

odbc32

ord11
ord24
ord36
ord16
ord13
ord43
ord75
ord31
ord7
ord39
ord9
ord4
ord29

ws2_32

__WSAFDIsSet
WSASocketA
sendto
WSAStartup
closesocket
connect
WSAGetLastError
socket
htons
gethostbyaddr
recv
send
select
inet_addr
ntohs
listen
accept
gethostbyname
shutdown
setsockopt
recvfrom
gethostname
bind
getservbyname
inet_ntoa

snmpapi

SnmpUtilVarBindListFree
SnmpUtilMemFree
SnmpUtilMemReAlloc

mgmtapi

SnmpMgrStrToOid
SnmpMgrOidToStr
SnmpMgrOpen
SnmpMgrRequest
SnmpMgrClose

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

wldap32

ord60
ord38
ord41
ord46
ord34
ord36
ord50
ord27
ord25
ord30
ord48
ord13
ord26

expat

XML_GetErrorCode
XML_SetCharacterDataHandler
XML_GetCurrentLineNumber
XML_ParserCreate
XML_SetUserData
XML_SetElementHandler
XML_Parse
XML_ParserFree
XML_ErrorString

zlib1

inflateEnd
inflate
inflateInit_

printaurus21

bServiceTerminating21
InformUsers
fService21

Exports

Exports

UNISPOOL_GENERAL_DeleteBuffer

Sections

.text
Size: 576KB - Virtual size: 574KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 88KB - Virtual size: 475KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eec802bf725bd48658aedd496eecae7c

Headers

File Characteristics

Imports

kernel32

user32

winspool.drv

advapi32

odbc32

ws2_32

snmpapi

mgmtapi

version

wldap32

expat

zlib1

printaurus21

Exports

Exports

Sections

.text Size: 576KB - Virtual size: 574KB

.rdata Size: 12KB - Virtual size: 9KB

.data Size: 88KB - Virtual size: 475KB

.rsrc Size: 28KB - Virtual size: 24KB

.text
Size: 576KB - Virtual size: 574KB

.rdata
Size: 12KB - Virtual size: 9KB

.data
Size: 88KB - Virtual size: 475KB

.rsrc
Size: 28KB - Virtual size: 24KB