c10a1a04333ad8989bdc8384d31704888b45535f04ef8e682c59154e72cde3c7

Sharing

Copy URL Twitter E-mail

General

Target

c10a1a04333ad8989bdc8384d31704888b45535f04ef8e682c59154e72cde3c7
Size

440KB
MD5

86944d566017786d5d669b70e0f26110
SHA1

46d8013d8e451bbcfb6e5e2f49decfdbaa6c1e6b
SHA256

c10a1a04333ad8989bdc8384d31704888b45535f04ef8e682c59154e72cde3c7
SHA512

be8ad1ef076ebc519c8038c5daf74743017bf55fe15dae186e5d30b7bfa2d560efbd2bc306af88e704efd5b780487242dce0d78d683df35ddd5102cd415501ab
SSDEEP

6144:HOLFwb6K0tJxlNVcWhBYJ0YQB3HoDd6BGd3T0FqFJXQ:uO6dN8S4YGLA

Score

N/A

Malware Config

Signatures

Files

c10a1a04333ad8989bdc8384d31704888b45535f04ef8e682c59154e72cde3c7
.dll windows x86

4f21492f703e9512bc3c21e4a3666b03

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_except_handler4_common
_amsg_exit
_initterm
free
malloc
_XcptFilter
memcpy
_vsnprintf
memset
printf

ntdll

RtlCreateTimer
NtQuerySystemTime
RtlExtendedLargeIntegerDivide
RtlDeleteTimer
RtlUpdateTimer
RtlCreateTimerQueue
RtlDeleteTimerQueue
NtCancelTimer
NtClose
NtSetTimer
RtlQueueWorkItem
RtlDeleteResource
RtlInitializeResource
RtlAcquireResourceShared
RtlAcquireResourceExclusive
RtlIpv6AddressToStringA
RtlReleaseResource
ord1

kernel32

InterlockedExchange
GetSystemTimeAsFileTime
SetEvent
SetLastError
GetTickCount
GlobalFree
ResetEvent
CreateTimerQueue
HeapCreate
DisableThreadLibraryCalls
Sleep
CreateEventA
WaitForSingleObject
CloseHandle
CreateSemaphoreA
GlobalAlloc
CreateTimerQueueTimer
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
InterlockedCompareExchange
HeapFree
HeapAlloc
InterlockedIncrement
InterlockedDecrement
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetLastError
ChangeTimerQueueTimer
DeleteTimerQueueTimer
InterlockedExchangeAdd
DeleteTimerQueueEx
HeapDestroy
ReleaseSemaphore

advapi32

RegCloseKey
RegCreateKeyExA
RegQueryValueExA
RegDeleteKeyA
RegSetValueExA
RegOpenKeyExA

rtutils

RouterLogRegisterA
TraceRegisterExA
TraceDeregisterA
TracePrintfExA
RouterLogEventA
RouterLogDeregisterA

ws2_32

htonl

Exports

Exports

BestMatchInTable
CheckTable
CreateTable
DeleteFromTable
DestroyTable
DumpTable
EnumOverTable
InsertIntoTable
MgmAddGroupMembershipEntry
MgmDeInitialize
MgmDeRegisterMProtocol
MgmDeleteGroupMembershipEntry
MgmGetFirstMfe
MgmGetFirstMfeStats
MgmGetMfe
MgmGetMfeStats
MgmGetNextMfe
MgmGetNextMfeStats
MgmGetProtocolOnInterface
MgmGroupEnumerationEnd
MgmGroupEnumerationGetNext
MgmGroupEnumerationStart
MgmInitialize
MgmRegisterMProtocol
MgmReleaseInterfaceOwnership
MgmTakeInterfaceOwnership
NextMatchInTable
RtmAddNextHop
RtmAddRoute
RtmAddRouteToDest
RtmBlockConvertRoutesToStatic
RtmBlockDeleteRoutes
RtmBlockMethods
RtmBlockSetRouteEnable
RtmCloseEnumerationHandle
RtmConvertIpv6AddressAndLengthToNetAddress
RtmConvertNetAddressToIpv6AddressAndLength
RtmCreateDestEnum
RtmCreateEnumerationHandle
RtmCreateNextHopEnum
RtmCreateRouteEnum
RtmCreateRouteList
RtmCreateRouteListEnum
RtmDeleteEnumHandle
RtmDeleteNextHop
RtmDeleteRoute
RtmDeleteRouteList
RtmDeleteRouteTable
RtmDeleteRouteToDest
RtmDequeueRouteChangeMessage
RtmDereferenceHandles
RtmDeregisterClient
RtmDeregisterEntity
RtmDeregisterFromChangeNotification
RtmEnumerateGetNextRoute
RtmFindNextHop
RtmGetAddressFamilyInfo
RtmGetChangeStatus
RtmGetChangedDests
RtmGetDestInfo
RtmGetEntityInfo
RtmGetEntityMethods
RtmGetEnumDests
RtmGetEnumNextHops
RtmGetEnumRoutes
RtmGetExactMatchDestination
RtmGetExactMatchRoute
RtmGetFirstRoute
RtmGetInstanceInfo
RtmGetInstances
RtmGetLessSpecificDestination
RtmGetListEnumRoutes
RtmGetMostSpecificDestination
RtmGetNetworkCount
RtmGetNextHopInfo
RtmGetNextHopPointer
RtmGetNextRoute
RtmGetOpaqueInformationPointer
RtmGetRegisteredEntities
RtmGetRouteAge
RtmGetRouteInfo
RtmGetRoutePointer
RtmHoldDestination
RtmIgnoreChangedDests
RtmInsertInRouteList
RtmInvokeMethod
RtmIsBestRoute
RtmIsMarkedForChangeNotification
RtmIsRoute
RtmLockDestination
RtmLockNextHop
RtmLockRoute
RtmLookupIPDestination
RtmMarkDestForChangeNotification
RtmReadAddressFamilyConfig
RtmReadInstanceConfig
RtmReferenceHandles
RtmRegisterClient
RtmRegisterEntity
RtmRegisterForChangeNotification
RtmReleaseChangedDests
RtmReleaseDestInfo
RtmReleaseDests
RtmReleaseEntities
RtmReleaseEntityInfo
RtmReleaseNextHopInfo
RtmReleaseNextHops
RtmReleaseRouteInfo
RtmReleaseRoutes
RtmUpdateAndUnlockRoute
RtmWriteAddressFamilyConfig
RtmWriteInstanceConfig
SearchInTable

Sections

.text
Size: 99KB - Virtual size: 98KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 328KB - Virtual size: 329KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4f21492f703e9512bc3c21e4a3666b03

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

kernel32

advapi32

rtutils

ws2_32

Exports

Exports

Sections

.text Size: 99KB - Virtual size: 98KB

.data Size: 328KB - Virtual size: 329KB

.rsrc Size: 7KB - Virtual size: 6KB

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 99KB - Virtual size: 98KB

.data
Size: 328KB - Virtual size: 329KB

.rsrc
Size: 7KB - Virtual size: 6KB

.reloc
Size: 5KB - Virtual size: 4KB