82950d5f533e3cf54f0a21391d72d14125c8eb5d2e80ede183f847ad6517f573

Sharing

Copy URL Twitter E-mail

General

Target

82950d5f533e3cf54f0a21391d72d14125c8eb5d2e80ede183f847ad6517f573
Size

864KB
MD5

91d080c037ba2c68f4bc41fb2b8b3dd1
SHA1

5dbe7d764cf7235bb5abe47d306ca651e653daf9
SHA256

82950d5f533e3cf54f0a21391d72d14125c8eb5d2e80ede183f847ad6517f573
SHA512

253b710a9dc8e276f15f3b9fa1d7e46284d0b04d132d8164bc23507e95caff65c49b71cf4b582a24026247d5222423d4ceeab35b81d9b0323b68757a611c2a04
SSDEEP

24576:RLt/T5po9sDawmcunUI/3zfQkJJ3F9h5PqHSV:RLt7f2sDawbIrYYJF7MI

Score

N/A

Malware Config

Signatures

Files

82950d5f533e3cf54f0a21391d72d14125c8eb5d2e80ede183f847ad6517f573
.exe windows x86

34a6bd3b28b31e84a7cb256e84548091

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetPrivateProfileSectionNamesA
GetConsoleOutputCP
SetCommConfig
DeleteCriticalSection
IsBadHugeWritePtr
ReadConsoleA
GlobalUnlock
IsValidCodePage
SetVolumeMountPointA
ReadFileScatter
IsBadStringPtrW
WriteTapemark
TlsGetValue
WritePrivateProfileStructA
MapUserPhysicalPages
GetDiskFreeSpaceA
GetFileAttributesExW
VirtualAllocEx
Module32NextW
GetProfileSectionW
GetNativeSystemInfo
EnterCriticalSection
VerifyVersionInfoA
ReadConsoleInputA
AttachConsole
EnumResourceTypesW
VirtualAlloc
GlobalAddAtomW
CloseProfileUserMapping
TlsFree
VirtualProtectEx
RegisterWowBaseHandlers
SetFileApisToANSI
LocalAlloc
FindResourceA
GetConsoleWindow
FindVolumeMountPointClose
WaitNamedPipeW
GetSystemWindowsDirectoryA
LoadLibraryA
LeaveCriticalSection
GetConsoleFontInfo
MoveFileExA
WaitForDebugEvent
_lread

rasman

IsRasmanProcess
RasActivateRouteEx
RasRpcDisconnect
RasSetDevConfig
RasServerPortClose
RasSetConnectionParams
RasSetPortUserData
RasPortOpenEx
RasGetPortUserData
RasRpcPortGetInfo
RasPortSetFramingEx
RasBundleGetStatisticsEx
RasGetNumPortOpen
RasPortGetBundledPort
RasPortListen
RasSecurityDialogGetInfo
RasPortBundle
RasDeviceGetInfo
RasEnumConnectionPorts
RasGetUserCredentials
RasRpcRemoteGetSystemDirectory
RasRequestNotification
RasLinkGetStatistics
RasSetRouterUsage
RasPortOpen
RasGetDeviceConfigInfo
RasAddConnectionPort
RasDeviceConnect
RasPortCancelReceive
RasGetConnectionParams
RasRegisterRedialCallback
RasRpcDeviceEnum
RasPortFree
RasGetHConnFromEntry
RasRpcRemoteGetUserPreferences
RasRpcGetErrorString
RasInitializeNoWait
RasRegisterPnPHandler
RasConnectionEnum
RasRPCBind
RasGetKey
RasRpcGetInstalledProtocolsEx
RasPortReceive
RasPortGetStatistics
RasInitialize

msvcrt20

fscanf
_adj_fptan
_fgetwchar
_atodbl
?put@ostream@@QAEAAV1@D@Z
_putenv
??_7strstream@@6B@
iswgraph
??3@YAXPAX@Z
wcsncat
fputws
??_Distream@@QAEXXZ
?sputbackc@streambuf@@QAEHD@Z
_control87
_locking
??0ios@@IAE@ABV0@@Z
_setjmp3
_fpieee_flt
??0stdiobuf@@QAE@PAU_iobuf@@@Z
_wmkdir
fwscanf
??0streambuf@@IAE@XZ
_chmod
?_query_new_mode@@YAHXZ
?rdbuf@ostrstream@@QBEPAVstrstreambuf@@XZ
_wfullpath
??_8strstream@@7Bistream@@@
?seekoff@streambuf@@UAEJJW4seek_dir@ios@@H@Z
_safe_fprem1
_execl
?attach@filebuf@@QAEPAV1@H@Z
_wexecl
_futime
??_Gios@@UAEPAXI@Z
ceil
ldiv

schannel

SpLsaModeInitialize
VerifySignature
DeleteSecurityContext
MakeSignature
FreeContextBuffer
QuerySecurityPackageInfoW
QueryContextAttributesW
InitializeSecurityContextW
AcquireCredentialsHandleA
ImpersonateSecurityContext
QueryContextAttributesA
SealMessage
SslGetMaximumKeySize
CompleteAuthToken
SslLoadCertificate
EnumerateSecurityPackagesW
EnumerateSecurityPackagesA
SslEmptyCacheW
SpUserModeInitialize
InitSecurityInterfaceW
SslGenerateRandomBits
RevertSecurityContext
AcquireCredentialsHandleW
AcceptSecurityContext
SslFreeCertificate
InitSecurityInterfaceA
FreeCredentialsHandle
InitializeSecurityContextA
ApplyControlToken
SslEmptyCacheA
QuerySecurityPackageInfoA
UnsealMessage
SslCrackCertificate

esent

JetStopBackupInstance
JetDetachDatabase
JetSetColumn@28
JetComputeStats
JetCreateTableColumnIndex2
JetStopService
JetRegisterCallback
JetBeginTransaction
JetSetCurrentIndex
JetExternalRestore
JetSetSystemParameter
JetOpenDatabase
JetSetColumnDefaultValue
JetCreateTableColumnIndex
JetSetCurrentIndex4
JetRetrieveColumn
JetSetDatabaseSize
JetSetSessionContext
JetBackupInstance
JetResetTableSequential
JetRenameTable
JetGetCursorInfo
JetBackup
JetSetColumn
JetGotoPosition
JetMove
JetBeginTransaction2
JetStopServiceInstance
JetDeleteIndex
JetGetInstanceInfo
JetDeleteColumn
JetUnregisterCallback
JetCloseFileInstance
JetRestore
JetGotoSecondaryIndexBookmark
JetFreeBuffer
JetMakeKey

hhsetup

?RemoveAll@CPointerList@@QAEXXZ
?GetCollectionFileNameW@CCollection@@QAEPBGXZ
?DeleteChildren@CCollection@@AAEXPAPAVCFolder@@@Z
?SetId@CLocation@@QAEXPBD@Z
?Close@CCollection@@QAEKXZ
?AddCollection@CCollection@@QAEPAVCColList@@XZ
??4CFIFOString@@QAEAAV0@ABV0@@Z
?GetPath@CLocation@@QAEPADXZ
??1CFIFOString@@QAE@XZ
??0CFolder@@QAE@XZ
?GetId@CLocation@@QBEPADXZ
??1CLocation@@QAE@XZ
??4CPointerList@@QAEAAV0@ABV0@@Z
?GetParent@CFolder@@QAEPAV1@XZ
?Next@CPointerList@@QAEPAUListItem@@PAU2@@Z
?SetTitle@CLocation@@QAEXPBD@Z
?HandleCollection@CCollection@@AAEKPAVCParseXML@@PAD@Z
?AddTail@CFIFOString@@QAEKPAD@Z
?SetId@CLocation@@QAEXPBG@Z
?FindTitle@CCollection@@QAEPAVCTitle@@PBDG@Z
?ConfirmTitles@CCollection@@QAEXXZ
?RemoveAll@CFIFOString@@QAEXXZ
?GetLanguage@CTitle@@QAEGXZ
?SetVersion@CCollection@@QAEXK@Z
?GetFirstChildFolder@CFolder@@QAEPAV1@XZ
?NewLocationHistory@CTitle@@QAEPAULocationHistory@@XZ
?Dirty@CCollection@@QAEXXZ
?GetTitleW@CFolder@@QAEPBGXZ
?bIsVisable@CFolder@@QAEHXZ
?FindTitle@CCollection@@QAEPAVCTitle@@PBGG@Z
??0CPointerList@@QAE@XZ
??4CLocation@@QAEAAV0@ABV0@@Z
?HandleFolder@CCollection@@AAEKPAVCParseXML@@PAD@Z
?GetIdW@CLocation@@QAEPBGXZ
?GetTitle@CFolder@@QAEPADXZ
?GetColNo@CCollection@@QAEKXZ

msvcrt

exit

Sections

.text
Size: 174KB - Virtual size: 174KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 317KB - Virtual size: 316KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 369KB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

34a6bd3b28b31e84a7cb256e84548091

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

rasman

msvcrt20

schannel

esent

hhsetup

msvcrt

Sections

.text Size: 174KB - Virtual size: 174KB

.rdata Size: 317KB - Virtual size: 316KB

.data Size: 369KB - Virtual size: 1.8MB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 1016B

.text
Size: 174KB - Virtual size: 174KB

.rdata
Size: 317KB - Virtual size: 316KB

.data
Size: 369KB - Virtual size: 1.8MB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 1016B