bb544a897ba82aabe71e99abf3f1859fec0138970a7bddc45166c99091431788

Sharing

Copy URL Twitter E-mail

General

Target

bb544a897ba82aabe71e99abf3f1859fec0138970a7bddc45166c99091431788
Size

44KB
MD5

62351705ae8bae102f06abb96cf29d66
SHA1

5c2f6ff3aa1290f8b1ada33c2d23ec4cc42856c6
SHA256

bb544a897ba82aabe71e99abf3f1859fec0138970a7bddc45166c99091431788
SHA512

baec198a6471c6baa5aca51db9e1f57ca21cf1029b2ecdf3a219ccb1aa4c7aa987ab062b52be8559eb3d718083fbcec4a4bf5f6b0cb0b3481edcf7adef7d387e
SSDEEP

768:OEQBESUJIC0wWGbas15Y2RrvzxGyG5ZNJB4DZPZs+kEhhjrBE:OEQSpJewdbPfx4DJBCBBhhjrBE

Score

N/A

Malware Config

Signatures

Files

bb544a897ba82aabe71e99abf3f1859fec0138970a7bddc45166c99091431788
.exe windows x86

1b39e0e55d94ef546414be2e8596950c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

gethostbyname
ntohs
WSAGetLastError
WSAStartup
WSACleanup
gethostbyaddr
inet_ntoa
inet_addr

iphlpapi

SendARP

kernel32

lstrlenW
lstrlenA
SetEvent
SystemTimeToFileTime
GetLocalTime
CreateEventA
WaitForSingleObject
GetExitCodeThread
WaitForMultipleObjects
Sleep
FreeLibrary
LoadLibraryA
OpenMutexA
GetCurrentThreadId
GetModuleFileNameA
CreateSemaphoreA
OpenEventA
OpenSemaphoreA
GetModuleHandleA
FileTimeToSystemTime
GetSystemTime
GetTickCount
QueryPerformanceCounter
ExitProcess
FindResourceA
LoadResource
InitializeCriticalSection
RaiseException
MultiByteToWideChar
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
GetCurrentProcessId
GetLastError
GetProcessHeap
CreateMutexA
LoadLibraryW
GetProcAddress

advapi32

CryptDecrypt
CryptEncrypt
CryptDestroyKey
CryptDestroyHash
CryptReleaseContext
RegCreateKeyExA
RegSetValueExA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
CryptHashData
CryptCreateHash
CryptAcquireContextA
CryptGetProvParam
CryptDeriveKey
CryptGetHashParam

ole32

CoUninitialize
CoInitialize
CoCreateInstance

oleaut32

SysAllocStringByteLen
SysAllocStringLen
SysStringByteLen
VariantInit
VarBstrCmp
SysStringLen
SysFreeString
SysAllocString
VariantClear

samlib

SamiSetDSRMPassword
SamEnumerateAliasesInDomain
SamQueryInformationUser
SamLookupIdsInDomain
SamOpenAlias
SamiLmChangePasswordUser
SamRemoveMultipleMembersFromAlias
SamiEncryptPasswords
SamTestPrivateFunctionsDomain
SamAddMemberToGroup
SamiChangeKeys
SamChangePasswordUser2
SamRidToSid

snmpapi

SnmpUtilOctetsFree
SnmpUtilPrintOid
SnmpUtilOidNCmp
SnmpTfxClose

Sections

.edata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 8KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 361KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 10KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1b39e0e55d94ef546414be2e8596950c

Headers

File Characteristics

Imports

ws2_32

iphlpapi

kernel32

advapi32

ole32

oleaut32

samlib

snmpapi

Sections

.edata Size: 10KB - Virtual size: 9KB

.text Size: 16KB - Virtual size: 15KB

.rdata Size: 3KB - Virtual size: 48KB

.edata Size: 8KB - Virtual size: 59KB

.data Size: 6KB - Virtual size: 361KB

.edata Size: 10KB - Virtual size: 34KB

.rsrc Size: 1KB - Virtual size: 1KB

.edata
Size: 10KB - Virtual size: 9KB

.text
Size: 16KB - Virtual size: 15KB

.rdata
Size: 3KB - Virtual size: 48KB

.edata
Size: 8KB - Virtual size: 59KB

.data
Size: 6KB - Virtual size: 361KB

.edata
Size: 10KB - Virtual size: 34KB

.rsrc
Size: 1KB - Virtual size: 1KB