1a660dae9d414b9e4be62394d1dde9760e7769e8b989347e155127122099bf73

Sharing

Copy URL Twitter E-mail

General

Target

1a660dae9d414b9e4be62394d1dde9760e7769e8b989347e155127122099bf73
Size

264KB
MD5

0cb85aed584cc6430701a500db1dac00
SHA1

43797d55f3a5d99256ece192b3000c37a6c932b8
SHA256

1a660dae9d414b9e4be62394d1dde9760e7769e8b989347e155127122099bf73
SHA512

2e872217a0277a573bb8cb282bc329436607963491971996feba6bd295a55425652c65f1fd78d815f69b01cdf5b3501bf6b0026454a650e251f371fc49cae80b
SSDEEP

6144:rSFMBhGpL6s9prjZXMb55sctGka5m12Dbvil:nUZN1Xgsc8G12Dc

Score

N/A

Malware Config

Signatures

Files

1a660dae9d414b9e4be62394d1dde9760e7769e8b989347e155127122099bf73
.dll windows x86

6049e81c4f53d80a991cedc1f95378eb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

sambar

sa_smtpmail
sa_wincgi_exec
sa_cgi_exec
sa_passwd_delete
sa_mbox_delete
sa_mlist_delete
sa_im_delete
sa_passwd_update
sa_passwd_add
sa_mbox_create
sa_im_create
sa_get_realpath
sa_mbox_exists
sa_im_exists
sa_passwd_list
sa_passwd_auth
sa_profile_get
sa_profile_set
sa_profile_save
sa_profile_exit
sa_friend_auth
sa_passwd_sqlauth
sa_passwd_lookup
sa_passwd_match
sa_passwd_verify
sa_conn_maptourl
sa_conn_maptodavdir
sa_profile_init
sa_conn_key
sa_conn_props
sa_send_header
sa_conn_flush
sa_conn_close
sa_scalar_init
sa_param
sa_send_macro
sa_conn_send
sa_cmd_init
sa_props_load
sa_ctx_props
sa_log2

wsock32

ioctlsocket
gethostbyaddr
setsockopt
closesocket
connect
htons
socket
gethostbyname
recv
send

msvcrt

_stricmp
_lseek
_mkdir
_adjust_fdiv
_initterm
getc
fread
memcmp
strncpy
strncmp
malloc
free
__mb_cur_max
_isctype
_pctype
_sopen
_locking
_read
atol
_write
_close
pow
atof
atoi
_errno
strstr
_iob
fprintf
memset
memcpy
strcmp
sprintf
strlen
strcpy

kernel32

DisableThreadLibraryCalls

Exports

Exports

cgi_module
dyndns_init
finance_init
ftp_connect
general_init
im_connect
irc_connect
jinit_read_bmp
login_init
mail_connect
netutils_init
security_connect
security_exit
security_filter
security_init
security_request
sendmail_init
sendmail_init2
telnet_connect
user_friend
user_login
user_logout
user_profile
wincgi_module

Sections

.text
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 220KB - Virtual size: 220KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6049e81c4f53d80a991cedc1f95378eb

Headers

File Characteristics

Imports

sambar

wsock32

msvcrt

kernel32

Exports

Exports

Sections

.text Size: 20KB - Virtual size: 18KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 12KB - Virtual size: 11KB

.reloc Size: 4KB - Virtual size: 2KB

.text Size: 220KB - Virtual size: 220KB

.text
Size: 20KB - Virtual size: 18KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 12KB - Virtual size: 11KB

.reloc
Size: 4KB - Virtual size: 2KB

.text
Size: 220KB - Virtual size: 220KB