ccdce82e852156f594074415506b3287e2e7da210736fce19a03ba2ff0fdb3d3

Sharing

Copy URL Twitter E-mail

General

Target

ccdce82e852156f594074415506b3287e2e7da210736fce19a03ba2ff0fdb3d3
Size

50KB
MD5

6f17a40f81203d54d8b2c7a3b560d5e0
SHA1

55f6929d96ecec69515a742ab70e0699f548e438
SHA256

ccdce82e852156f594074415506b3287e2e7da210736fce19a03ba2ff0fdb3d3
SHA512

027ef2fe19d71b9dff9afcaf1df6f95fee9ab5280a945ec4b0bfaff24d95bde734b84b4d2b4da09b2a63cca1ac85b4ff9240effb0a8b9693a5764fe33562f197
SSDEEP

1536:1EeoCc3shdbdN2KoOgW8PcSuIBNsCoQRki2:hcmbpoZW/SXBuCJRki

Score

N/A

Malware Config

Signatures

Files

ccdce82e852156f594074415506b3287e2e7da210736fce19a03ba2ff0fdb3d3
.exe windows x86

8ebff312787f339ba187a416456f13cd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

sqlunirl

_lstrcpy_@8
_CreateFont@56
_LookupPrivilegeName_@16
_LookupAccountSid_@28
_DeviceCapabilities_@20
_QueryServiceConfig_@16
_SendMessageTimeout_@28
_LoadKeyboardLayout_@8
_CreateMetaFile_@4
_BackupEventLog_@8
_FindFirstFileEx_@24
_DragQueryFile_@16
_CharToOemBuff_@12
_CreateAcceleratorTable_@8
_LoadLibraryEx_@12
_CharUpper@4
_CreateProcess_@40
_NDdeShareGetInfo_@28
_WriteProfileString_@12
_GrayString_@36
_NDdeShareAdd_@20
wsprintf_
_DefDlgProc_@16
_NDdeSetShareSecurity_@16
_ReplaceText_@4
_GetMenuString_@20
newWideCharFromMultiByte
_GetProcAddress_@8
_QueryServiceLockStatus_@16
_PrivilegedServiceAuditAlarm_@20
_RemoveDirectory_@4
_VkKeyScanEx_@8

ws2_32

WSASetEvent
WSAIsBlocking
WSASetBlockingHook
WSCDeinstallProvider
WSCGetProviderPath
WSCEnableNSProvider
getservbyport
getprotobynumber
recv
WSAGetQOSByName
WSALookupServiceNextW
send
htonl
getnameinfo
WSAInstallServiceClassA
gethostbyaddr
WSAEnumProtocolsA
WPUCompleteOverlappedRequest
WSAProviderConfigChange
WSAAsyncGetHostByName
WSCInstallProvider
getpeername
bind
WSAEventSelect
WSANtohl
WSASendTo
WSCWriteProviderOrder
inet_ntoa
WSAStringToAddressW
WSALookupServiceBeginW

kernel32

GetComputerNameW
ActivateActCtx
GetTickCount
GetConsoleNlsMode
OpenFile
LZDone
GetExitCodeProcess
FillConsoleOutputCharacterA
SetThreadPriority
GetProcessWorkingSetSize
AddConsoleAliasW
DeleteFiber
LoadLibraryA
Heap32First
QueryPerformanceCounter
AddConsoleAliasA
GetDiskFreeSpaceExW
CancelWaitableTimer
GetSystemWow64DirectoryW
EscapeCommFunction
CreateDirectoryA
GetNamedPipeInfo
VDMConsoleOperation
GetConsoleAliasExesW
GetACP
WaitForSingleObjectEx
VirtualAlloc
OpenFileMappingA
LZOpenFileA
SetConsoleHardwareState
RegisterWaitForSingleObject
SetMailslotInfo
GetDiskFreeSpaceA
InitializeCriticalSectionAndSpinCount
VerifyVersionInfoW
lstrcat

msdart

?SetDefaultSpinCount@CSmallSpinLock@@SGXG@Z
?InsertHead@CLockedDoubleList@@QAEXQAVCListEntry@@@Z
?_DeleteIf@CLKRLinearHashTable@@AAEKP6G?AW4LK_PREDICATE@@PBXPAX@Z1AAW42@@Z
??1CCritSec@@QAE@XZ
??1CSmallSpinLock@@QAE@XZ
?ReadUnlock@CFakeLock@@QAEXXZ
??0CSpinLock@@QAE@XZ
??4CLockedSingleList@@QAEAAV0@ABV0@@Z
?InsertTail@CLockedDoubleList@@QAEXQAVCListEntry@@@Z
?GetDefaultSpinAdjustmentFactor@CReaderWriterLock3@@SGNXZ
?GetDefaultSpinAdjustmentFactor@CSmallSpinLock@@SGNXZ
?IsWin98orLater@CMdVersionInfo@@SAHXZ
?_CmpExch@CReaderWriterLock3@@AAE_NJJ@Z
?_ExtractKey@CLKRHashTable@@ABE?BKPBX@Z
?ConvertSharedToExclusive@CReaderWriterLock@@QAEXXZ
?_WriteLockSpin@CReaderWriterLock@@AAEXXZ
?Apply@CLKRLinearHashTable@@QAEKP6G?AW4LK_ACTION@@PBXPAX@Z1W4LK_LOCKTYPE@@@Z
?_ReadLockSpin@CReaderWriterLock@@AAEXXZ
?IsValid@CLKRHashTable@@QBE_NXZ
?DeleteKey@CLKRHashTable@@QAE?AW4LK_RETCODE@@K@Z
?_ReadLockSpin@CReaderWriterLock2@@AAEXXZ
?ReadOrWriteUnlock@CFakeLock@@QAEX_N@Z
?SetDefaultSpinCount@CFakeLock@@SGXG@Z
?_Clear@CLKRLinearHashTable@@AAEX_N@Z
?ConvertSharedToExclusive@CReaderWriterLock2@@QAEXXZ
?_WriteLockSpin@CReaderWriterLock3@@AAEXXZ
?sm_dblDfltSpinAdjFctr@CReaderWriterLock2@@1NA
?WriteLock@CSpinLock@@QAEXXZ

Sections

.text
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8ebff312787f339ba187a416456f13cd

Headers

DLL Characteristics

File Characteristics

Imports

sqlunirl

ws2_32

kernel32

msdart

Sections

.text Size: 40KB - Virtual size: 40KB

.rdata Size: 7KB - Virtual size: 6KB

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: 40KB - Virtual size: 40KB

.rdata
Size: 7KB - Virtual size: 6KB

.rsrc
Size: 1KB - Virtual size: 1KB