e640c3587d534f81504f9b71dbe8600b74214b5b1f18edad1979f3a712448b77

Sharing

Copy URL Twitter E-mail

General

Target

e640c3587d534f81504f9b71dbe8600b74214b5b1f18edad1979f3a712448b77
Size

41KB
MD5

9be916902366fa4b71808502b9a6f303
SHA1

966bd14640a0ded1de086f4f66708743d4225e04
SHA256

e640c3587d534f81504f9b71dbe8600b74214b5b1f18edad1979f3a712448b77
SHA512

922f4868bc98dab4df15d2749124ba656d22d2db3a050ddd834f833e6497985949efe4fa1a782eed75b1288c118b5858f3e6f49211fdf4b343fdf2c5f5af9fcc
SSDEEP

768:rpxFRInbw06ppJasjFjsd0PH/CKwOGPfncMXM1QA7dHmCt4bAjJ25i:FxOb8zasxjsdWH/CNOmf9XAJHmCt4bAV

Score

N/A

Malware Config

Signatures

Files

e640c3587d534f81504f9b71dbe8600b74214b5b1f18edad1979f3a712448b77
.dll windows x86

385dd9a619e16e1f89818ea3f38398c3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

NtOpenEventPair
NtEnumerateKey
NtFsControlFile
ZwFreeUserPhysicalPages
NtFlushBuffersFile
ZwDeleteFile
ZwDebugActiveProcess
ZwFreeVirtualMemory
NtCreateSemaphore
NtImpersonateAnonymousToken
ZwDeleteKey

kernel32

GlobalDeleteAtom
IsDebuggerPresent
DuplicateHandle
GetPrivateProfileIntA
TlsSetValue
GetCurrentDirectoryW
RaiseException
CreateFileA
lstrcpyW
GetModuleFileNameA
GlobalAlloc
GetStdHandle
WritePrivateProfileStructA
GetProcessHeap
CreateEventW
TerminateProcess
WaitForSingleObject
GetTempFileNameW
CloseHandle
CreateFileW
GetEnvironmentVariableW
VirtualAlloc
SetThreadExecutionState
TlsGetValue
InterlockedExchangeAdd
CreateSemaphoreA
SetLastError
GetVersion
CreateProcessW
CopyFileW
GlobalAddAtomW
CreateThread
GetLocaleInfoW

Exports

Exports

GetUniDirectionalAdapterInfo
CreateProcessNotify
ftppSNK
DeleteIpNetEntry
DeleteProxyArpEntry
GetIfEntry
GetOwnerModuleFromTcp6Entry
GetAdaptersInfo
SetIpTTL
IpReleaseAddress
NotifyAddrChange
InternalGetTcpTable
GetAdapterIndex
IcmpCloseHandle
GetInterfaceInfo
GetOwnerModuleFromUdp6Entry
GetTcpStatistics
NTTimeToNTPTime
GetIpStatistics
InternalGetIfTable
IcmpSendEcho2
GetIcmpStatistics
CreateIpNetEntry
InternalSetIpStats
InternalSetIpForwardEntry
GetIpErrorString
InternalSetTcpEntry
NhGetInterfaceNameFromGuid
InternalDeleteIpNetEntry
NhGetInterfaceNameFromDeviceGuid
GetBestRoute
GetOwnerModuleFromTcpEntry
GetOwnerModuleFromUdpEntry
GetIpStatisticsEx
register_icmp
GetIpNetTable
CreateProxyArpEntry
InternalDeleteIpForwardEntry
UnenableRouter
Icmp6SendEcho2
NhGetGuidFromInterfaceName
InternalGetIpAddrTable
IpRenewAddress
CreateIpForwardEntry
GetAdapterOrderMap
GetIcmpStatisticsEx
SendARP
DisableMediaSense
GetIpForwardTable
GetUdpStatistics
IcmpSendEcho
InternalCreateIpNetEntry
Icmp6CreateFile
AllocateAndGetIpAddrTableFromStack
SetIpStatistics
IcmpParseReplies
CancelIPChangeNotify
GetBestInterface
InternalGetIpForwardTable
GetUdpTable
IcmpCreateFile
DeleteIpForwardEntry
GetRTTAndHopCount
RestoreMediaSense
do_echo_rep
InternalGetUdpTable
GetTcpTable
EnableRouter
GetIfTable
FlushIpNetTable
SetIpForwardEntry
InternalSetIpNetEntry
GetExtendedTcpTable
SetIfEntry

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 205B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 30KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

385dd9a619e16e1f89818ea3f38398c3

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

Exports

Exports

Sections

.text Size: 9KB - Virtual size: 9KB

.data Size: 512B - Virtual size: 205B

.rsrc Size: 30KB - Virtual size: 32KB

.reloc Size: 512B - Virtual size: 4KB

.text
Size: 9KB - Virtual size: 9KB

.data
Size: 512B - Virtual size: 205B

.rsrc
Size: 30KB - Virtual size: 32KB

.reloc
Size: 512B - Virtual size: 4KB