2edd3a03393f24aada2cdab972e91237366a4800b829468eed478ce7fa570548

Sharing

Copy URL

Twitter E-mail

General

Target

2edd3a03393f24aada2cdab972e91237366a4800b829468eed478ce7fa570548
Size

160KB
MD5

8c16c7585c6cfd881cf59f0e1e114456
SHA1

dfc91660fdd3535502c94054ccd9585eca77d634
SHA256

2edd3a03393f24aada2cdab972e91237366a4800b829468eed478ce7fa570548
SHA512

ac49cfaf82861679e8196b6eda68218d0b79b8e04600f3cb3d960146156c04ca2fcaeaed2a8a9176a37b62fe1d09e903133382de8aea1bc541f5a8040bb25dce
SSDEEP

3072:96/aib1+sV341h86+SC4J8oTS/VjCG7qx3PxONnCWMBl:QIn3+5CGebONCTl

Score

N/A

Malware Config

Signatures

Files

2edd3a03393f24aada2cdab972e91237366a4800b829468eed478ce7fa570548
.dll windows x86

6d3b7ee475598d634f7e506636f6247c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameA
WritePrivateProfileStringA
GetPrivateProfileIntA
GetPrivateProfileStringA
lstrcpyA
SetFileAttributesA
lstrlenA
GetFileAttributesA
GetPrivateProfileStructA
WritePrivateProfileStructA
GetVersionExA
GetTickCount
Sleep
InterlockedIncrement
InterlockedDecrement
GlobalLock
DeleteCriticalSection
lstrcatA
GlobalUnlock
GlobalHandle
GlobalFree
IsBadWritePtr
FindClose
FindNextFileA
FindFirstFileA
GetProcAddress
LoadLibraryA
FreeLibrary
CloseHandle
WaitForSingleObject
ResetEvent
CreateEventA
SetThreadPriority
SetEvent
EnterCriticalSection
InitializeCriticalSection
GetCurrentThreadId
GlobalAlloc
GlobalReAlloc
InterlockedExchange
SetLastError
TlsGetValue
HeapFree
TlsAlloc
FlushFileBuffers
LCMapStringW
LCMapStringA
SetStdHandle
GetOEMCP
GetACP
GetCPInfo
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
LeaveCriticalSection
UnhandledExceptionFilter
GetLastError
CreateThread
TlsSetValue
ExitThread
RtlUnwind
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
HeapReAlloc
HeapAlloc
HeapSize
VirtualAlloc
SetFilePointer
TlsFree
GetEnvironmentStrings
GetEnvironmentStringsW
GetStringTypeW
GetStringTypeA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
HeapDestroy
GetModuleHandleA
GetEnvironmentVariableA
HeapCreate
VirtualFree
WriteFile
MultiByteToWideChar

user32

SendMessageA
PostThreadMessageA
PostMessageA
GetMessageA
RegisterWindowMessageA
wsprintfA
SetTimer
KillTimer
GetWindowLongA
DefWindowProcA
DestroyWindow
UnregisterClassA
RegisterClassA
SetWindowsHookExA
CreateWindowExA
UnhookWindowsHookEx
SetWindowLongA
DispatchMessageA

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

wsock32

htonl
ntohl
htons
ntohs

cltrans

ord170

Exports

Exports

AuSrvcAssert
AuSrvcAuaddrToNsaddr
AuSrvcBindInstanceToContext
AuSrvcCSCreate
AuSrvcCSDelete
AuSrvcCSEnter
AuSrvcCSLeave
AuSrvcChangeContext
AuSrvcChangeContextByInstance
AuSrvcChgDWordH2N
AuSrvcChgDWordN2H
AuSrvcChgWordH2N
AuSrvcChgWordN2H
AuSrvcDebugSetModuleID
AuSrvcDebugSetModuleName
AuSrvcDebugTraceX
AuSrvcFindPlugIn
AuSrvcFindPlugInClose
AuSrvcFindPlugInEx
AuSrvcFreePlugIn
AuSrvcGetAddrID
AuSrvcGetContext
AuSrvcGetDebugLevel
AuSrvcGetLocalAddress
AuSrvcGetOsVersion
AuSrvcGetPrivateProfileInt
AuSrvcGetPrivateProfileIntCf
AuSrvcGetPrivateProfileString
AuSrvcGetPrivateProfileStringCf
AuSrvcGetPrivateProfileStruct
AuSrvcGetProfileInt
AuSrvcGetProfileIntEx
AuSrvcGetProfileString
AuSrvcGetProfileStringEx
AuSrvcGetRegValue
AuSrvcGetTickCount
AuSrvcInitializeProfile
AuSrvcIsBadWritePtr
AuSrvcLoadPlugIn
AuSrvcMakeAddrByService
AuSrvcMemAlloc
AuSrvcMemFree
AuSrvcMemReAlloc
AuSrvcNsaddrToAuaddr
AuSrvcPostMessage
AuSrvcPrivateIntializeProfile
AuSrvcSendMessage
AuSrvcShutdown
AuSrvcSleep
AuSrvcStartup
AuSrvcThreadCreate
AuSrvcThreadDestroy
AuSrvcTimerStart
AuSrvcTimerStop
AuSrvcWritePrivateProfileInt
AuSrvcWritePrivateProfileString
AuSrvcWritePrivateProfileStruct
AuSrvcWriteProfileInt
AuSrvcWriteProfileString
AuSrvcYield
AuSrvcYieldToMain

Sections

.text
Size: 56KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 80KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6d3b7ee475598d634f7e506636f6247c

Headers

File Characteristics

Imports

kernel32

user32

advapi32

version

wsock32

cltrans

Exports

Exports

Sections

.text Size: 56KB - Virtual size: 53KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 80KB - Virtual size: 85KB

.rsrc Size: 4KB - Virtual size: 968B

.reloc Size: 8KB - Virtual size: 4KB

.text
Size: 56KB - Virtual size: 53KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 80KB - Virtual size: 85KB

.rsrc
Size: 4KB - Virtual size: 968B

.reloc
Size: 8KB - Virtual size: 4KB