6396f7f020b771d587e40a7b0fe72e47f5272c92dd6006af3da1339f106bbd4d

Sharing

Copy URL

Twitter E-mail

General

Target

6396f7f020b771d587e40a7b0fe72e47f5272c92dd6006af3da1339f106bbd4d
Size

698KB
MD5

6261cf322a29f601f828a3d86586b5b0
SHA1

16e7ab1998e470ecdfb287077394dbaf4104c21e
SHA256

6396f7f020b771d587e40a7b0fe72e47f5272c92dd6006af3da1339f106bbd4d
SHA512

f1a426e90597a08a3fa1dcbde56849bf2164bc9f2bb631755fd34c951fceb6027e895bed67de96894ee34142f1ada8bddfa0acc2be0aa977e30b402eb6ba434c
SSDEEP

6144:PhHm+P6Iocp5INmrT4y3uIKPRThMRm7BYRvvYDTDvYGsZXvy0VksScaH8Mx6UwU8:PgNmrTZ3udcmy5KAGsJy3zLsYkzPRMY

Score

N/A

Malware Config

Signatures

Files

6396f7f020b771d587e40a7b0fe72e47f5272c92dd6006af3da1339f106bbd4d
.dll windows x86

6576759d818ac2e9c390f27697077a19

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_ltoa
_wcsnicmp
_wtol
atol
_except_handler3
_local_unwind2
wcsncpy
wcslen
wcspbrk
_wcsicmp
wcstoul
wcsstr
??2@YAPAXI@Z
wcscpy
wcscmp
sprintf
vsprintf
wcscat
qsort
memmove
atoi
iswdigit
free
_initterm
_ftol
??3@YAXPAX@Z
wcsncmp
malloc
_adjust_fdiv

ntdll

DbgPrint
RtlGetNtProductType
RtlNtStatusToDosError

advapi32

FreeSid
AllocateAndInitializeSid
CheckTokenMembership
RegEnumKeyExA
RegOpenKeyExA
RegConnectRegistryW
RegEnumKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumValueW
RegQueryInfoKeyW
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetSidSubAuthority
ChangeServiceConfigW
ControlService
StartServiceW
QueryServiceStatus
OpenSCManagerW
OpenServiceW
CloseServiceHandle
OpenThreadToken
OpenProcessToken
GetSidLengthRequired
InitializeSid
RegCloseKey
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
SetSecurityDescriptorOwner

gdi32

GetTextExtentPoint32W
TranslateCharsetInfo
DeleteDC
LineTo
MoveToEx
ExtTextOutW
CreatePen
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
CreateFontIndirectW
GetObjectW
GetStockObject
GetDeviceCaps
DeleteObject
SetTextColor
SetBkColor
BitBlt
GetClipBox
PatBlt
GetCharWidthW
CreateSolidBrush
GetTextExtentPointW
GetTextMetricsW

kernel32

GetCurrentThreadId
GetCurrentProcessId
FreeLibrary
GetProcAddress
LoadLibraryW
lstrcpynW
lstrlenW
lstrcatW
ReleaseMutex
WaitForSingleObject
Sleep
lstrlenA
CreateProcessW
SetLastError
LoadLibraryA
lstrcmpiW
CloseHandle
FindClose
FindNextFileW
FindFirstFileW
IsBadWritePtr
CompareStringW
WideCharToMultiByte
lstrcpyW
GlobalDeleteAtom
CreateMutexW
GlobalAddAtomW
SetEvent
GetTickCount
CreateThread
CreateEventW
ExpandEnvironmentStringsW
LoadLibraryExW
GlobalReAlloc
DelayLoadFailureHook
InterlockedCompareExchange
QueryPerformanceCounter
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
LockResource
LoadResource
FindResourceW
HeapCreate
InitializeCriticalSection
DeleteCriticalSection
HeapDestroy
LeaveCriticalSection
EnterCriticalSection
HeapAlloc
GetProcessHeap
HeapFree
CreateProcessA
GetSystemDirectoryA
GetCurrentThread
GetLocaleInfoW
GetLocaleInfoA
GetNumberFormatW
GetModuleHandleW
GetWindowsDirectoryW
GetModuleFileNameW
CreateFileW
lstrcmpW
GetLastError
FormatMessageW
LocalFree
GlobalAlloc
GlobalFree
InterlockedIncrement
CreateDirectoryW
MultiByteToWideChar
LocalAlloc
GetSystemDirectoryW
GetVersionExW
lstrcmpiA
lstrcpyA
GetSystemWindowsDirectoryW
OpenMutexA
CreateMutexA
GetFullPathNameW
InterlockedDecrement
GetACP
MulDiv
GetThreadLocale
GlobalUnlock
GlobalLock
GetComputerNameW

mprapi

MprAdminPortDisconnect
MprAdminBufferFree
MprAdminPortEnum
MprAdminIsServiceRunning
MprAdminConnectionEnum
MprAdminConnectionGetInfo
MprAdminServerDisconnect
MprAdminServerConnect
MprAdminUserServerDisconnect
MprAdminUserWriteProfFlags
MprAdminUserServerConnect
MprAdminUserReadProfFlags
MprAdminUserOpen
MprAdminUserRead
MprAdminUserClose
MprAdminUserWrite
MprAdminInterfaceDelete

ole32

CoUninitialize
CoCreateInstance
CoSetProxyBlanket
CoInitializeEx
CoTaskMemFree
CLSIDFromString

rasapi32

RasScriptGetIpAddress
RasGetEapUserDataW
RasfileFindNextKeyLine
RasScriptTerm
RasScriptReceive
RasScriptSend
RasSetAutodialAddressW
RasfileGetKeyValueFields
RasGetAutodialAddressW
RasfileClose
RasfileDeleteLine
RasfileGetLineMark
RasfileFindFirstLine
RasfilePutLineMark
RasfileFindLastLine
RasfilePutKeyValueFields
RasfileFindNextLine
RasfileInsertLine
RasScriptInit
RasfileFindPrevLine
RasfileGetLine
RasfilePutSectionName
RasfileFindSectionLine
RasfileWrite
RasfileGetSectionName
RasfileLoad

rasman

RasGetDeviceConfigInfo
RasSetDeviceConfigInfo
RasGetCustomScriptDll
RasSetCommSettings
RasIsTrustedCustomDll
RasSendNotification
RasGetDeviceNameW
RasGetUnicodeDeviceName
RasRpcSetUserPreferences
RasRpcGetUserPreferences
RasRpcGetSystemDirectory
RasRpcGetInstalledProtocolsEx
RasRpcGetInstalledProtocols
RasRpcGetVersion
RasGetInfo

tapi32

lineTranslateDialogW
lineSetCurrentLocation
LOpenDialAsst
lineGetCountryW
lineGetTranslateCapsW
lineConfigDialogW
lineTranslateAddressW

user32

SendMessageA
CreateIconIndirect
GetIconInfo
LoadIconW
MessageBoxW
SendDlgItemMessageW
DialogBoxParamW
ShowCursor
SetCursor
LoadCursorW
ExitWindowsEx
LoadStringW
GetDlgItemTextW
SetCaretPos
GetCaretPos
CreateWindowExW
RegisterClassW
GetClassInfoW
GetKeyState
SetWindowsHookExW
PeekMessageW
UnhookWindowsHookEx
PostMessageW
GetClientRect
GetDC
GetSysColorBrush
ReleaseDC
WinHelpW
SetDlgItemTextW
SetForegroundWindow
GetWindowTextW
wsprintfW
SetDlgItemInt
GetDlgItemInt
SetWindowPos
ShowWindow
SetTimer
IsDlgButtonChecked
KillTimer
CheckDlgButton
LoadImageW
EndDialog
SetWindowLongW
GetDlgItem
SetWindowTextW
GetParent
EnableWindow
GetFocus
IsWindowEnabled
SetFocus
GetWindowLongW
SendMessageW
GetWindowRect
RemovePropW
GetActiveWindow
InvalidateRect
UpdateWindow
LoadBitmapW
GetWindowTextLengthW
EnumChildWindows
EnumWindows
SetPropW
GetPropW
CallWindowProcW
DestroyIcon
CharNextW
CharPrevW
GetDlgCtrlID
MapWindowPoints
ScreenToClient
IsWindowVisible
GetSystemMetrics
InflateRect
GetSysColor
EnumThreadWindows
GetCursorPos
DestroyWindow
MessageBeep
DefWindowProcW
EndPaint
SetRect
FillRect
BeginPaint
DrawFocusRect
DrawTextW

ws2_32

ntohs
htonl
htons

rpcrt4

I_RpcExceptionFilter
RpcBindingFree
UuidCreate

Exports

Exports

DwTerminalDlg
GetRasDialOutProtocols
RasAutodialDisableDlgA
RasAutodialDisableDlgW
RasAutodialQueryDlgA
RasAutodialQueryDlgW
RasDialDlgA
RasDialDlgW
RasEntryDlgA
RasEntryDlgW
RasMonitorDlgA
RasMonitorDlgW
RasPhonebookDlgA
RasPhonebookDlgW
RasSrvAddPropPages
RasSrvAddWizPages
RasSrvAllowConnectionsConfig
RasSrvCleanupService
RasSrvEnumConnections
RasSrvHangupConnection
RasSrvInitializeService
RasSrvIsConnectionConnected
RasSrvIsServiceRunning
RasSrvQueryShowIcon
RasUserEnableManualDial
RasUserGetManualDial
RasUserPrefsDlg
RasWizCreateNewEntry
RasWizGetNCCFlags
RasWizGetSuggestedEntryName
RasWizGetUserInputConnectionName
RasWizIsEntryRenamable
RasWizQueryMaxPageCount
RasWizSetEntryName
RouterEntryDlgA
RouterEntryDlgW

Sections

.text
Size: 318KB - Virtual size: 317KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 60KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 297KB - Virtual size: 297KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6576759d818ac2e9c390f27697077a19

Headers

File Characteristics

Imports

msvcrt

ntdll

advapi32

gdi32

kernel32

mprapi

ole32

rasapi32

rasman

tapi32

user32

ws2_32

rpcrt4

Exports

Exports

Sections

.text Size: 318KB - Virtual size: 317KB

.data Size: 60KB - Virtual size: 62KB

.rsrc Size: 297KB - Virtual size: 297KB

.reloc Size: 21KB - Virtual size: 21KB

.text
Size: 318KB - Virtual size: 317KB

.data
Size: 60KB - Virtual size: 62KB

.rsrc
Size: 297KB - Virtual size: 297KB

.reloc
Size: 21KB - Virtual size: 21KB