ed850d7e9cd4cafe17b7f01ad2ad2d2575f3c3a3b70af83d5caa3ab24e96bbe9

Sharing

Copy URL

Twitter E-mail

General

Target

ed850d7e9cd4cafe17b7f01ad2ad2d2575f3c3a3b70af83d5caa3ab24e96bbe9
Size

332KB
MD5

1cce6b12bfa53bedf479aff133112bfb
SHA1

9f5876f2138222c00ac45294f9d4d8adbb9b642f
SHA256

ed850d7e9cd4cafe17b7f01ad2ad2d2575f3c3a3b70af83d5caa3ab24e96bbe9
SHA512

83318637966268b5439cbae4311076a3a7e3703bd08885834de1b27d763a68312e23823174cbad499bcdccd1aaa5ed48f25cfaa5198210f2a68276508a1f71c8
SSDEEP

6144:NRAKBYfRzcxGbSfEzmT94sOr7r1m0qayd6m4RmMQI3gXJh:NbDqm0qT6dRv3Aj

Score

N/A

Malware Config

Signatures

Files

ed850d7e9cd4cafe17b7f01ad2ad2d2575f3c3a3b70af83d5caa3ab24e96bbe9
.dll windows x86

6315868b0579319768824f5087396cae

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

tosbdapi

?BdWriteData2@@YAHPAXG0KPAK@Z
?BdOpen@@YAPAXXZ
?BdReadDataEx@@YAHPAXG0KPAH1PAUHWND__@@II@Z
?BdClose@@YAHPAX@Z

kernel32

WaitForMultipleObjects
GetOverlappedResult
ReadFile
ResetEvent
SetNamedPipeHandleState
CreateFileA
WideCharToMultiByte
WriteFile
lstrcmpW
GetVersionExA
GetCurrentProcess
LocalFree
GlobalFree
Sleep
GlobalAlloc
CompareStringA
lstrlenA
GetPrivateProfileStringA
lstrcatA
GlobalFlags
IsBadReadPtr
HeapFree
HeapAlloc
GetProcessHeap
LeaveCriticalSection
EnterCriticalSection
GlobalUnlock
GlobalLock
HeapReAlloc
HeapSize
SetEvent
GlobalReAlloc
GlobalSize
InitializeCriticalSection
DeleteCriticalSection
CreateProcessA
SetStdHandle
LoadLibraryA
GetProcAddress
GetOEMCP
GetACP
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
GetCPInfo
SetFilePointer
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetExitCodeThread
CreateThread
GetCurrentProcessId
ProcessIdToSessionId
CreateEventA
GetLastError
OutputDebugStringA
CreateMutexA
WaitForSingleObject
ReleaseMutex
CloseHandle
FlushFileBuffers
lstrcpyA
GetFileType
GetStdHandle
SetHandleCount
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
GetCurrentThreadId
TerminateProcess
GetCommandLineA
GetVersion
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
ExitProcess
RtlUnwind
InterlockedDecrement
InterlockedIncrement

user32

SetPropA
SetWindowTextA
DestroyWindow
RegisterWindowMessageA
CreateDialogParamA
wvsprintfA
IsWindow
GetWindowTextA
SendMessageA
PeekMessageA
wsprintfA
RemovePropA
PostQuitMessage
FindWindowA
GetPropA
DefWindowProcA
RegisterClassA
CreateWindowExA
GetMessageA
TranslateMessage
DispatchMessageA
PostMessageA

advapi32

RegOpenKeyExA
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityInfo
ConvertStringSidToSidA
DuplicateTokenEx
GetLengthSid
SetTokenInformation
CreateProcessAsUserA
OpenProcessToken
GetTokenInformation
GetUserNameW
RegQueryValueExA
RegCloseKey

ole32

StringFromGUID2
CoCreateGuid

wtsapi32

WTSQuerySessionInformationW
WTSFreeMemory

setupapi

SetupDiGetClassDevsA
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyA
SetupDiDestroyDeviceInfoList

Exports

Exports

BtAccept
BtAddHIDDevice
BtAddHIDDevice2
BtAddLinkKey
BtAddRemoteDevice
BtAddServiceAttribute
BtAddServiceRecord
BtAddUUIDs4RefreshSDDB
BtAnalyzeDIAttributeLists
BtAnalyzeProtocolParameter
BtAnalyzeProtocolParameter2
BtAnalyzeServiceAttributeLists
BtAnalyzeServiceAttributeLists2
BtAssignPSM
BtAssignSCN
BtBWCAuth
BtBeginLANEServer
BtCanHIDHostSupport
BtCancelDiscoverRemoteDevice
BtCancelListen
BtCancelNotify
BtCancelPinCodeNotify
BtCancelRefreshSDDB
BtChangeHIDSettings
BtCheckBTUUIDINFO
BtCheckTOSHIBASpecialDevice
BtClearAutoReplyPinCode
BtClearIOCapabilityResponse
BtClearOOBDataRequestReply
BtCloseAPI
BtCloseDrivers
BtConfigRequest
BtConfigResponse
BtConnect
BtConnectCOMM
BtConnectCOMM2
BtConnectHID
BtConnectLANE
BtConnectPAN
BtConnectSDP
BtCreateCOMM
BtCreateCOMM2
BtCreateCOMMEx
BtDeleteLinkKey
BtDestroyCOMM
BtDisconnect
BtDisconnectCOMM
BtDisconnectHID
BtDisconnectLANE
BtDisconnectPAN
BtDisconnectSDP
BtDiscoverRemoteDevice
BtDiscoverRemoteDevice2
BtDiscoverRemoteEIRDataList
BtDiscoverRemoteName
BtEndLANEServer
BtExecBtMng
BtFreeCOMMPort
BtFreePBTANALYZEDATTRLIST2
BtFreePBTANALYZEDDIATTRLIST
BtFreePSM
BtFreeSCN
BtGetActiveStackInfo
BtGetAutoConnectCOMMInfoList
BtGetAutoReplyPinCode
BtGetAutomaticRefreshSDDBMode
BtGetBTUUIDINFO16
BtGetBTUUIDINFO32
BtGetBondingMode
BtGetCIDList
BtGetCIDList2
BtGetCOMMCreatorName
BtGetCOMMCreatorName2
BtGetCOMMInfoList
BtGetCOMMInfoList2
BtGetClassOfDevice
BtGetConnectabilityMode
BtGetConnectedDeviceList
BtGetConnectedDeviceList2
BtGetConnectionHandle
BtGetDevicePropertyParam
BtGetDiscoverabilityMode
BtGetEncryptionMode
BtGetHCRPInfoList
BtGetHIDInfoList
BtGetIOCapabilityResponse
BtGetLANECreatorName
BtGetLANEInfoList
BtGetLANEMaxConnections
BtGetLastInquiryTime
BtGetLinkKey
BtGetLinkPolicy
BtGetLinkQuality
BtGetLinkSupervisionTimeout
BtGetLocalDeviceName
BtGetLocalEIRData
BtGetLocalInfo
BtGetLocalInfo2
BtGetLocalOOBData
BtGetMITMProtectionMode
BtGetPANInfoList
BtGetPSMList
BtGetPairingMode
BtGetPeriodicInquiryMode
BtGetPowerState
BtGetPowerSwitch
BtGetRSSI
BtGetRemoteClassOfDevice
BtGetRemoteDeviceList
BtGetRemoteDeviceList2
BtGetRemoteEIRDataList
BtGetRemoteName
BtGetRemoteSimplePairingMode
BtGetRoleState
BtGetSecurityLevel
BtGetSecurityMode
BtGetSecurityMode2
BtGetSensitivityAndPowerMode
BtGetServiceLevelSecurityInfo
BtGetServiceRecordHandleList
BtGetServiceRecordHandleList2
BtGetSimplePairingMode
BtGetUUIDs4RefreshSDDB
BtGetUUIDs4RefreshSDDB2
BtGetWakeupOnDeviceDiscoveredPolicy
BtGetWakeupOnIncomingConnectinPolicy
BtKeepCOMMPort
BtListen
BtLockSetSecurityLevel
BtMakeAttributeIDList
BtMakeAttributeIDList2
BtMakeBTUUIDINFO
BtMakeServiceSearchPattern
BtMakeServiceSearchPattern2
BtMemAlloc
BtMemFree
BtMemReAlloc
BtMemSize
BtModifyServiceAttribute
BtNotify
BtNotifyCOMM
BtNotifyEvent
BtNotifyLANE
BtNotifyPAN
BtOpenAPI
BtOpenDrivers
BtPANCancelListen
BtPANEnableDHCP
BtPANListen
BtPANRecvData
BtPANSendData
BtPANSwitchRole
BtPinCodeNotify
BtPinCodeReply
BtQosSetup
BtRecvData
BtRefreshSDDB
BtRefreshSDDB2
BtReject
BtRemoveHIDDevice
BtRemoveRemoteDevice
BtRemoveServiceAttribute
BtRemoveServiceRecord
BtRemoveUUIDs4RefreshSDDB
BtResetTrustedDevice
BtRoleDiscovery
BtSendData
BtServiceAttribute
BtServiceAttribute2
BtServiceAttributeSDDB
BtServiceAttributeSDDB2
BtServiceSearch
BtServiceSearch2
BtServiceSearchAttribute
BtServiceSearchAttribute2
BtServiceSearchAttributeSDDB
BtServiceSearchAttributeSDDB2
BtServiceSearchSDDB
BtServiceSearchSDDB2
BtSetAutoConnectCOMMInfo
BtSetAutoConnectCOMMState
BtSetAutoReplyPinCode
BtSetAutomaticRefreshSDDBMode
BtSetBondingMode
BtSetClassOfDevice
BtSetConnectabilityMode
BtSetDevicePropertyParam
BtSetDiscoverabilityMode
BtSetEncryptionMode
BtSetIOCapabilityResponse
BtSetLinkPolicy
BtSetLinkSupervisionTimeout
BtSetLocalDeviceName
BtSetLocalEIRData
BtSetMITMProtectionMode
BtSetOOBDataRequestReply
BtSetPairingMode
BtSetPeriodicInquiryMode
BtSetPowerState
BtSetPowerSwitch
BtSetRoleState
BtSetSecurityLevel
BtSetSecurityMode
BtSetSecurityMode2
BtSetSensitivityAndPowerMode
BtSetServiceLevelSecurityInfo
BtSetSimplePairingMode
BtSetTrustedDevice
BtSetWakeupOnDeviceDiscoveredPolicy
BtSetWakeupOnIncomingConnectinPolicy
BtShowDevicePropertyPage
BtSwitchRole
BtUnlockSetSecurityLevel

Sections

.text
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 251KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 168KB - Virtual size: 165KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6315868b0579319768824f5087396cae

Headers

File Characteristics

Imports

tosbdapi

kernel32

user32

advapi32

ole32

wtsapi32

setupapi

Exports

Exports

Sections

.text Size: 112KB - Virtual size: 111KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 28KB - Virtual size: 251KB

.rsrc Size: 168KB - Virtual size: 165KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 112KB - Virtual size: 111KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 28KB - Virtual size: 251KB

.rsrc
Size: 168KB - Virtual size: 165KB

.reloc
Size: 8KB - Virtual size: 7KB