c1863a6f87098b9e690624d2c0efd501cbf35d6924afcb19e5ddc76863689336

Sharing

Copy URL Twitter E-mail

General

Target

c1863a6f87098b9e690624d2c0efd501cbf35d6924afcb19e5ddc76863689336
Size

391KB
MD5

5a1a07f9bcbff8c8ffd3322022fc4e7f
SHA1

8f980a9c051766c02d06f804c9443ba49f99ef26
SHA256

c1863a6f87098b9e690624d2c0efd501cbf35d6924afcb19e5ddc76863689336
SHA512

09dcb6e4ca1f3b7246df62cf4e4b2e7172fc2fc41dddd3852d8ca674ae6df025d0927e97c359d5057b58439ac9fdf98abb24927c6fe861b1d1ffabad45cf7be8
SSDEEP

6144:UBKu4781loQ27bc8gKPdW7bBHNSXpI5tEPVe3hoGQePUxKczyA:023wq2jSXpetEPVcUQU7yA

Score

N/A

Malware Config

Signatures

Files

c1863a6f87098b9e690624d2c0efd501cbf35d6924afcb19e5ddc76863689336
.dll windows x86

19f56f6f9b79d9de4755682e72bec782

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_wcsicmp
mbstowcs
fclose
atoi
_strnicmp
strpbrk
fgets
memmove
fprintf
fputs
_except_handler3
fputc
qsort
free
realloc
_snwprintf
_itow
wcschr
bsearch
wcscat
wcscpy
wcslen
_initterm
malloc
_adjust_fdiv
_purecall
??2@YAPAXI@Z
wcscmp
wcstombs
_snprintf
wcsrchr
wcspbrk
iswalpha
wcsncmp
_wcsnicmp
iswdigit
??3@YAXPAX@Z
wcstoul
_ultow
fopen

atl

ord20
ord17
ord19
ord32
ord21
ord16

ntdll

RtlFindClearBitsAndSet
RtlClearBits
RtlFindSetBits
NtDeviceIoControlFile
RtlInitializeBitMap
RtlClearAllBits
NtCreateFile
RtlImpersonateSelf
NtUnloadDriver
NtLoadDriver
RtlQueueWorkItem
RtlRandom
RtlDeregisterWait
RtlRegisterWait
NtCreateEvent
RtlInitializeGenericTable
RtlDeleteElementGenericTable
RtlGetElementGenericTable
RtlNumberGenericTableElements
RtlLookupElementGenericTable
RtlEnumerateGenericTable
RtlAnsiStringToUnicodeString
NtOpenFile
RtlFreeHeap
RtlAllocateHeap
NtQuerySymbolicLinkObject
NtOpenSymbolicLinkObject
RtlIpv4StringToAddressW
RtlIpv4AddressToStringW
RtlNtStatusToDosError
RtlCreateTimerQueue
RtlCreateTimer
RtlUpdateTimer
RtlDeleteTimerQueue
RtlDeleteTimer
NtOpenKey
NtClose
RtlInitUnicodeString
NtQueryValueKey
RtlInsertElementGenericTable
NtQueryInformationProcess
RtlInitString
RtlAdjustPrivilege
NtSetEvent
RtlFreeUnicodeString
RtlStringFromGUID
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
RtlInitAnsiString
RtlDeregisterWaitEx
NtNotifyChangeKey

advapi32

AccessCheck
RevertToSelf
QueryServiceConfigW
CloseServiceHandle
QueryServiceStatus
OpenServiceW
OpenSCManagerW
StartServiceW
FreeSid
AllocateAndInitializeSid
GetTokenInformation
LookupAccountSidW
OpenProcessToken
EqualSid
DuplicateTokenEx
CreateProcessAsUserW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegisterServiceCtrlHandlerW
SetServiceStatus
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
OpenThreadToken
CheckTokenMembership
CreateWellKnownSid
SetTraceCallback
OpenTraceW
ProcessTrace
CloseTrace
StartTraceW
EnableTrace
ControlTraceW
RemoveTraceCallback
QueryServiceConfigA
RegCreateKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegEnumValueW
RegDeleteValueW
RegNotifyChangeKeyValue

dnsapi

Dns_BuildPacket
DnsUtf8ToUnicode
DnsGetBufferLengthForStringCopy
Dns_ParseMessage
DnsFreeConfigStructure
DnsQueryConfigAllocEx
DnsNameCompare_W
DnsGetPrimaryDomainName_A
DnsQuery_W
DnsRecordListFree
DnsQuery_UTF8

iphlpapi

NhpAllocateAndGetInterfaceInfoFromStack
SetIpForwardEntryToStack
AllocateAndGetIpAddrTableFromStack
AllocateAndGetIfTableFromStack
GetIpNetTable
SendARP
NotifyAddrChange
GetPerAdapterInfo
GetAdaptersInfo
GetInterfaceInfo
UnenableRouter
EnableRouter
GetAdaptersAddresses

kernel32

CreateTimerQueue
DeleteTimerQueueEx
UnregisterWaitEx
SystemTimeToFileTime
FileTimeToSystemTime
GetComputerNameExW
FormatMessageW
LocalAlloc
GetCurrentThread
DuplicateHandle
OpenProcess
GetSystemDirectoryW
MultiByteToWideChar
WideCharToMultiByte
SetLastError
QueueUserWorkItem
lstrcmpiW
lstrlenA
lstrcpyA
lstrcmpiA
LocalFree
SetEvent
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceW
LoadLibraryW
lstrcmpW
CreateFileW
ExpandEnvironmentStringsA
InterlockedCompareExchange
ExpandEnvironmentStringsW
LoadLibraryExW
GetLongPathNameW
CreateDirectoryW
InitializeCriticalSectionAndSpinCount
MoveFileExW
lstrcatW
FileTimeToLocalFileTime
DeleteTimerQueueTimer
TerminateThread
GetFileSize
GetLocalTime
CreateTimerQueueTimer
CreateThread
GetComputerNameW
GetVersionExW
Sleep
ResumeThread
WTSGetActiveConsoleSessionId
DeviceIoControl
lstrcpyW
InterlockedExchange
WaitForSingleObject
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
BindIoCompletionCallback
CreateEventW
RegisterWaitForSingleObject
HeapAlloc
GetProcessHeap
InterlockedDecrement
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
HeapFree
InterlockedIncrement
DeleteCriticalSection
GetProcAddress
LoadLibraryA
CloseHandle
GetLastError
CreateEventA
FreeLibrary
DisableThreadLibraryCalls
lstrlenW
UnregisterWait
ReadFile
WriteFile

mprapi

MprInfoDelete
MprInfoBlockAdd
MprInfoBlockFind
MprInfoCreate

mswsock

AcceptEx

rasapi32

RasQuerySharedConnection
RasGetCredentialsW
RasDialW
RasHangUpW
RasGetConnectionStatistics
RasConnectionNotificationW
RasGetEntryPropertiesW
RasQuerySharedAutoDial
RasGetAutodialAddressA
RasGetEntryHrasconnW
RasGetProjectionInfoA
RasAutoDialSharedConnection

rtutils

TracePrintfExA
TraceRegisterExW
RouterLogDeregisterW
RouterLogRegisterA
TraceVprintfExA
TraceDeregisterW
TraceRegisterExA
RouterLogEventValistExA

ws2_32

socket
connect
ntohs
htons
inet_addr
inet_ntoa
WSAProviderConfigChange
setsockopt
WSAIoctl
bind
WSASendTo
WSARecvFrom
WSAAddressToStringA
WSAEnumProtocolsW
WSASocketW
htonl
ntohl
WSACleanup
WSAStartup
closesocket
getsockname
WSAGetLastError

ole32

CoTaskMemFree
CoUninitialize
CLSIDFromString
CoSwitchCallContext
CoImpersonateClient
CoRevertToSelf
StringFromGUID2
CoTaskMemAlloc
CoCreateInstance
CoInitializeEx

oleaut32

VariantInit
CreateErrorInfo
SetErrorInfo
LoadRegTypeLi
SysFreeString
SysAllocString
SysAllocStringLen
SysStringLen
VariantClear

shlwapi

PathIsRelativeW
PathFindNextComponentW
PathCanonicalizeW
ord487
AssocQueryStringW
PathFindFileNameW
PathSkipRootW

wtsapi32

WTSQuerySessionInformationW
WTSFreeMemory

netshell

NcFreeNetconProperties

rasman

RasInitialize
RasReferenceRasman

wmi

WmiCloseBlock
WmiSetSingleInstanceW
WmiOpenBlock

authz

AuthzInitializeResourceManager
AuthziLogAuditEvent
AuthzFreeAuditEvent
AuthzFreeResourceManager

rpcrt4

RpcServerUnregisterIfEx
RpcBindingVectorFree
RpcEpUnregister
RpcEpRegisterW
RpcServerInqBindings
RpcServerRegisterIfEx
RpcServerUseProtseqW
RpcBindingInqAuthClientW
RpcStringBindingParseW
RpcBindingToStringBindingW
I_RpcBindingIsClientLocal
I_RpcBindingInqLocalClientPID
NdrServerCall2
RpcServerRegisterAuthInfoW
RpcStringFreeW
RpcRaiseException
RpcRevertToSelf
RpcImpersonateClient
RpcServerInqDefaultPrincNameW

user32

LoadStringW

Exports

Exports

NatAcquirePortReservation
NatCancelDynamicRedirect
NatCancelRedirect
NatCreateDynamicFullRedirect
NatCreateDynamicRedirect
NatCreateDynamicRedirectEx
NatCreateRedirect
NatCreateRedirectEx
NatInitializePortReservation
NatInitializeTranslator
NatLookupAndQueryInformationSessionMapping
NatQueryInformationRedirect
NatQueryInformationRedirectHandle
NatReleasePortReservation
NatShutdownPortReservation
NatShutdownTranslator
NhAcceptStreamSocket
NhAcquireFixedLengthBuffer
NhAcquireVariableLengthBuffer
NhCreateDatagramSocket
NhCreateStreamSocket
NhDeleteSocket
NhInitializeBufferManagement
NhInitializeTraceManagement
NhReadDatagramSocket
NhReadStreamSocket
NhReleaseBuffer
NhWriteDatagramSocket
NhWriteStreamSocket
RegisterProtocol
ServiceMain

Sections

.text
Size: 258KB - Virtual size: 258KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 71KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

19f56f6f9b79d9de4755682e72bec782

Headers

File Characteristics

Imports

msvcrt

atl

ntdll

advapi32

dnsapi

iphlpapi

kernel32

mprapi

mswsock

rasapi32

rtutils

ws2_32

ole32

oleaut32

shlwapi

wtsapi32

netshell

rasman

wmi

authz

rpcrt4

user32

Exports

Exports

Sections

.text Size: 258KB - Virtual size: 258KB

.data Size: 71KB - Virtual size: 76KB

.rsrc Size: 43KB - Virtual size: 43KB

.reloc Size: 16KB - Virtual size: 16KB

.text
Size: 258KB - Virtual size: 258KB

.data
Size: 71KB - Virtual size: 76KB

.rsrc
Size: 43KB - Virtual size: 43KB

.reloc
Size: 16KB - Virtual size: 16KB