a73f02ef9411cbcdf48461d03d7b7c0e93540e7f801435307892cd959081c907

Sharing

Copy URL Twitter E-mail

General

Target

a73f02ef9411cbcdf48461d03d7b7c0e93540e7f801435307892cd959081c907
Size

43KB
MD5

8b7361cebdde8b7f2024bd2315550b00
SHA1

b7b2a137d6bb96f4b2bb2976737a244dd75d8319
SHA256

a73f02ef9411cbcdf48461d03d7b7c0e93540e7f801435307892cd959081c907
SHA512

2df5200106f1bf174b49136274c6cee19a82b1c866fe50f6cbd13cc59c2a2435de41ec8c992f06dd482b51f610fba2b0636923f8b4929817a9ebdb11f7991ebc
SSDEEP

768:+/5jbXiRSxSEMj2007s3wAnoV9jLhPsjLY5BI6AujjWM7dufkdFqJMvPSj0cnrdD:nShRh+YXdsj05BI6AujjKfkvqmv6jjr

Score

N/A

Malware Config

Signatures

Files

a73f02ef9411cbcdf48461d03d7b7c0e93540e7f801435307892cd959081c907
.dll windows x86

6a4b1be09b0327d8c688e87e4b8250d5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegDeleteValueA
RegEnumKeyExA
RegQueryInfoKeyA

shlwapi

wnsprintfA
StrToIntA
StrStrA

ws2_32

ioctlsocket
WSAStartup
WSACleanup
WSASetLastError
select
getsockopt
__WSAFDIsSet
WSAGetLastError
gethostbyname
socket
setsockopt
connect
recv
send
shutdown
closesocket
sendto
inet_ntoa
recvfrom
getsockname
bind
inet_addr
htonl
htons

kernel32

ExitProcess
GetModuleFileNameA
GetWindowsDirectoryA
GetStartupInfoA
CreateProcessA
OpenThread
TerminateThread
GetExitCodeThread
lstrcpynA
GetVersion
SetFileAttributesA
DeleteFileA
lstrcpyA
GetEnvironmentVariableA
GetCurrentThread
SetThreadPriority
FreeLibraryAndExitThread
lstrlenA
HeapFree
GetLastError
IsBadWritePtr
HeapSize
HeapReAlloc
GetProcessHeap
HeapAlloc
lstrcatA
GetTimeZoneInformation
GetSystemTime
OpenFile
IsBadReadPtr
ExitThread
GetTickCount
Sleep
SetLastError
CloseHandle
GetCurrentThreadId
CreateThread
CreateMutexA
OpenMutexA
ReadFile
GetFileSize
CreateFileA
WriteFile
WaitForSingleObject
ReleaseMutex
HeapValidate

user32

CharLowerA
wsprintfA

dnsapi

DnsExtractRecordsFromMessage_W
DnsQuery_A
DnsRecordListFree

shell32

ShellExecuteA

Exports

Exports

GetThreadBot

Sections

.text
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6a4b1be09b0327d8c688e87e4b8250d5

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

shlwapi

ws2_32

kernel32

user32

dnsapi

shell32

Exports

Exports

Sections

.text Size: 33KB - Virtual size: 33KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 103KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 33KB - Virtual size: 33KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 103KB

.reloc
Size: 3KB - Virtual size: 3KB