96baa0a2e1ce2cd3202d02d0744d77edde9c7247b8ce3c2cd813fd4d9c7f3eef

Sharing

Copy URL

Twitter E-mail

General

Target

96baa0a2e1ce2cd3202d02d0744d77edde9c7247b8ce3c2cd813fd4d9c7f3eef
Size

828KB
MD5

b07f1c8988875c0e7e55718f97194f62
SHA1

a91cd97aa4bb61bb3040c24b0675bc2e36858abb
SHA256

96baa0a2e1ce2cd3202d02d0744d77edde9c7247b8ce3c2cd813fd4d9c7f3eef
SHA512

b6a298dca95621f496c0f770907dd2384b368454d824b23823bb03ed9b1bf635d3f8166133578607acf4ac16d9a9fe1dc231770b4d938b24ee675f0da65c01c4
SSDEEP

24576:RXV+AiSDfJofnUs6KyCVEqLeBICDn3yitwA:lLL6n6K1VEqLeBXn3UA

Score

N/A

Malware Config

Signatures

Files

96baa0a2e1ce2cd3202d02d0744d77edde9c7247b8ce3c2cd813fd4d9c7f3eef
.exe windows x86

5b45c0065871d8f5c86a779bf79ecff7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mlang

ConvertINetString
LcidToRfc1766A
DllCanUnloadNow
ConvertINetReset
Rfc1766ToLcidA
DllGetClassObject
GetGlobalFontLinkObject
Rfc1766ToLcidW
ConvertINetUnicodeToMultiByte
IsConvertINetStringAvailable
ConvertINetMultiByteToUnicode
LcidToRfc1766W

dhcpcsvc

DhcpAcquireParametersByBroadcast
DhcpEnumClasses
DhcpAcquireParameters
DhcpUndoRequestParams
McastGenUID
DhcpLeaseIpAddressEx
DhcpRegisterParamChange
McastEnumerateScopes
DhcpNotifyConfigChange
DhcpFallbackRefreshParams
DhcpRemoveDNSRegistrations
DhcpReleaseIpAddressLeaseEx

mfcsubs

??0CSyncObject@@QAE@PBG@Z
??O@YG_NABVCString@@PBG@Z
?Unlock@CSyncObject@@UAEHJPAJ@Z
??4CString@@QAEABV0@ABV0@@Z
?Release@CString@@KGXPAUCStringData@@@Z
?SafeStrlen@CString@@KGHPBG@Z
??0CString@@QAE@PBGH@Z
?Create@CPlex@@SGPAU1@AAPAU1@II@Z
??4CPlex@@QAEAAU0@ABU0@@Z
??0CString@@QAE@GH@Z
?Format@CString@@QAAXIZZ
?RemoveAll@CMapStringToPtr@@QAEXXZ
??BCString@@QBEPBGXZ
?GetNextAssoc@CMapStringToPtr@@QBEXAAPAU__POSITION@@AAVCString@@AAPAX@Z
?HashKey@CMapStringToPtr@@QBEIPBG@Z
?GetBuffer@CString@@QAEPAGH@Z
??1CObject@@UAE@XZ
??H@YG?AVCString@@ABV0@0@Z
??9@YG_NABVCString@@PBG@Z
??M@YG_NABVCString@@PBG@Z
?Add@CStringArray@@QAEHPBG@Z
?NewAssoc@CMapStringToPtr@@IAEPAUCAssoc@1@XZ
?Collate@CString@@QBEHPBG@Z
??_7CSyncObject@@6B@
??H@YG?AVCString@@PBGABV0@@Z
??0CCriticalSection@@QAE@XZ
?Mid@CString@@QBE?AV1@H@Z

kernel32

lstrcpyW
CommConfigDialogW
DosPathToSessionPathW
InterlockedDecrement
ReadConsoleInputW
GlobalUnWire
CreateProcessInternalA
RemoveDirectoryA
VDMConsoleOperation
GetModuleHandleW
GetDateFormatW
GetModuleHandleA
SetConsoleMode
GetSystemTimeAdjustment
EnumSystemLocalesW
lstrcat
GetTempPathW
CompareFileTime
GetCommConfig
BeginUpdateResourceA
GetCurrentThread
LoadLibraryW
SetCommMask
_lread
CopyLZFile
SetUserGeoID
FindResourceExA
GlobalUnlock
SetComputerNameA
CreateMemoryResourceNotification
WriteFile
GetLocaleInfoA

shell32

StrRChrIA
DoEnvironmentSubstA
SHGetFileInfo
SHInvokePrinterCommandA
SHAddToRecentDocs
SheGetDirA
SHBindToParent
StrChrIA
SHFormatDrive
SHExtractIconsW
Shell_NotifyIconA
DoEnvironmentSubstW
SHGetIconOverlayIndexA
StrCmpNIA
ShellAboutA
SHGetSettings
Control_RunDLL
SheSetCurDrive
ShellAboutW
SHUpdateRecycleBinIcon
DllUnregisterServer
SHChangeNotify
SHPathPrepareForWriteA
SHCreateDirectoryExA
SHCreateProcessAsUserW
ShellExecuteEx
ShellExec_RunDLLA
Options_RunDLLW
StrStrW
StrRStrIA

advapi32

IsValidSecurityDescriptor
WmiMofEnumerateResourcesA
ObjectOpenAuditAlarmA
GetMultipleTrusteeOperationW
LsaLookupSids
LookupPrivilegeNameW
ElfBackupEventLogFileA
IsValidAcl
SystemFunction013
GetUserNameA
GetPrivateObjectSecurity
GetMultipleTrusteeA
CryptGetDefaultProviderA
ConvertStringSidToSidA
InstallApplication
RegLoadKeyW

cabinet

Extract
FCIAddFile
FDICopy
GetDllVersion
FDITruncateCabinet
FCICreate
DllGetVersion
FCIFlushCabinet
FDIIsCabinet
DeleteExtractedFiles
FCIDestroy
FDIDestroy

Sections

.text
Size: 387KB - Virtual size: 386KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 123KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 165KB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 151KB - Virtual size: 150KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 852B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5b45c0065871d8f5c86a779bf79ecff7

Headers

DLL Characteristics

File Characteristics

Imports

mlang

dhcpcsvc

mfcsubs

kernel32

shell32

advapi32

cabinet

Sections

.text Size: 387KB - Virtual size: 386KB

.rdata Size: 123KB - Virtual size: 122KB

.data Size: 165KB - Virtual size: 1.6MB

.rsrc Size: 151KB - Virtual size: 150KB

.reloc Size: 1024B - Virtual size: 852B

.text
Size: 387KB - Virtual size: 386KB

.rdata
Size: 123KB - Virtual size: 122KB

.data
Size: 165KB - Virtual size: 1.6MB

.rsrc
Size: 151KB - Virtual size: 150KB

.reloc
Size: 1024B - Virtual size: 852B