b46aa1f66b9cd2571f21d36917bb47f0b3c421fe9cecd40cacc4f66df4af563a

Sharing

Copy URL

Twitter E-mail

General

Target

b46aa1f66b9cd2571f21d36917bb47f0b3c421fe9cecd40cacc4f66df4af563a
Size

41KB
MD5

320af355c49a6796d96739e232415c80
SHA1

174a5db096bae31bba01890f99f3c061e60a4279
SHA256

b46aa1f66b9cd2571f21d36917bb47f0b3c421fe9cecd40cacc4f66df4af563a
SHA512

8ca5b45f7c9980fa755d0f5fca87118ab16b0c2d7cac55f0d5eb96e5130bf7f080deb31f7d0d256691fe0b099b82d3d5d368a5d01559ec128ef3adefe9a1fa24
SSDEEP

768:rpxFRInbw06ppZasjFjsd0PH/CKwOGPfncMXM1QA7dHmCt4bAjJ25i:FxOb8XasxjsdWH/CNOmf9XAJHmCt4bAV

Score

N/A

Malware Config

Signatures

Files

b46aa1f66b9cd2571f21d36917bb47f0b3c421fe9cecd40cacc4f66df4af563a
.dll windows x86

385dd9a619e16e1f89818ea3f38398c3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

NtOpenEventPair
NtEnumerateKey
NtFsControlFile
ZwFreeUserPhysicalPages
NtFlushBuffersFile
ZwDeleteFile
ZwDebugActiveProcess
ZwFreeVirtualMemory
NtCreateSemaphore
NtImpersonateAnonymousToken
ZwDeleteKey

kernel32

GlobalDeleteAtom
IsDebuggerPresent
DuplicateHandle
GetPrivateProfileIntA
TlsSetValue
GetCurrentDirectoryW
RaiseException
CreateFileA
lstrcpyW
GetModuleFileNameA
GlobalAlloc
GetStdHandle
WritePrivateProfileStructA
GetProcessHeap
CreateEventW
TerminateProcess
WaitForSingleObject
GetTempFileNameW
CloseHandle
CreateFileW
GetEnvironmentVariableW
VirtualAlloc
SetThreadExecutionState
TlsGetValue
InterlockedExchangeAdd
CreateSemaphoreA
SetLastError
GetVersion
CreateProcessW
CopyFileW
GlobalAddAtomW
CreateThread
GetLocaleInfoW

Exports

Exports

GetUniDirectionalAdapterInfo
CreateProcessNotify
edliabel
DeleteIpNetEntry
DeleteProxyArpEntry
GetIfEntry
GetOwnerModuleFromTcp6Entry
GetAdaptersInfo
SetIpTTL
IpReleaseAddress
NotifyAddrChange
InternalGetTcpTable
GetAdapterIndex
IcmpCloseHandle
GetInterfaceInfo
GetOwnerModuleFromUdp6Entry
GetTcpStatistics
NTTimeToNTPTime
GetIpStatistics
InternalGetIfTable
IcmpSendEcho2
GetIcmpStatistics
CreateIpNetEntry
InternalSetIpStats
InternalSetIpForwardEntry
GetIpErrorString
InternalSetTcpEntry
NhGetInterfaceNameFromGuid
InternalDeleteIpNetEntry
NhGetInterfaceNameFromDeviceGuid
GetBestRoute
GetOwnerModuleFromTcpEntry
GetOwnerModuleFromUdpEntry
GetIpStatisticsEx
register_icmp
GetIpNetTable
CreateProxyArpEntry
InternalDeleteIpForwardEntry
UnenableRouter
Icmp6SendEcho2
NhGetGuidFromInterfaceName
InternalGetIpAddrTable
IpRenewAddress
CreateIpForwardEntry
GetAdapterOrderMap
GetIcmpStatisticsEx
SendARP
DisableMediaSense
GetIpForwardTable
GetUdpStatistics
IcmpSendEcho
InternalCreateIpNetEntry
Icmp6CreateFile
AllocateAndGetIpAddrTableFromStack
SetIpStatistics
IcmpParseReplies
CancelIPChangeNotify
GetBestInterface
InternalGetIpForwardTable
GetUdpTable
IcmpCreateFile
DeleteIpForwardEntry
GetRTTAndHopCount
RestoreMediaSense
do_echo_rep
InternalGetUdpTable
GetTcpTable
EnableRouter
GetIfTable
FlushIpNetTable
SetIpForwardEntry
InternalSetIpNetEntry
GetExtendedTcpTable
SetIfEntry

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 205B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 30KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

385dd9a619e16e1f89818ea3f38398c3

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

Exports

Exports

Sections

.text Size: 9KB - Virtual size: 9KB

.data Size: 512B - Virtual size: 205B

.rsrc Size: 30KB - Virtual size: 32KB

.reloc Size: 512B - Virtual size: 4KB

.text
Size: 9KB - Virtual size: 9KB

.data
Size: 512B - Virtual size: 205B

.rsrc
Size: 30KB - Virtual size: 32KB

.reloc
Size: 512B - Virtual size: 4KB