038ce9dd428d4688f1832737490dd97fc0c22c81a2123901cdb871237ea18e41

Sharing

Copy URL Twitter E-mail

General

Target

038ce9dd428d4688f1832737490dd97fc0c22c81a2123901cdb871237ea18e41
Size

250KB
MD5

d64a44e58bc60cebf16735cf59e31110
SHA1

d2842b2e8028db8b0c09671e2b11eefbd8d46174
SHA256

038ce9dd428d4688f1832737490dd97fc0c22c81a2123901cdb871237ea18e41
SHA512

6689d7767b35fc13a7ff9f5d1cb1f3ae2f3f5dff3e53b38706aa14d81b085e83e684c02105413c4486d66cf9b6b4a6850dd0a008447d572abf61f6109fd838f8
SSDEEP

6144:pPfoR4pO3Lp34jVR5DusWUdykuy15ufFGMbVJ:pXoqpopgVR57yFy15sIMxJ

Score

N/A

Malware Config

Signatures

Files

038ce9dd428d4688f1832737490dd97fc0c22c81a2123901cdb871237ea18e41
.dll windows x86

8167643435218efc93cf49ec995833c7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

glmf32

glsHeaderiv
glsUCS2toUTF8z
glsGLRCLayer
glsGetHeaderiv
glsCharubz
glsHeaderGLRCi
glsBeginCapture
glsRequireExtension

rasmxs

DeviceSetInfo
DeviceWork
DeviceDone
DeviceGetInfo
DeviceConnect
DeviceEnum
DeviceListen

msvcrt40

__p__osver
_msize
islower
_mbscmp
__p__wpgmptr
??4istream@@IAEAAV0@PAVstreambuf@@@Z
?pword@ios@@QBEAAPAXH@Z
_wmktemp
_adj_fdivr_m64
?put@ostream@@QAEAAV1@E@Z

uniplat

UnimodemNotifyTSP
StartMonitorThread
AllocateOverStructEx
MonitorHandle
CreateUnimodemTimer
WinntIsWorkstation
SetUnimodemTimer
SyncDeviceIoControl
DestroyOverStructPool
StopMonitoringHandle
CancelUnimodemTimer
UnimodemDeviceIoControlEx
FreeUnimodemTimer
ResetCallCount
StopMonitorThread
ReinitOverStruct
UnimodemReadFileEx
UmPlatformDeinitialize
UmPlatformInitialize
CreateOverStructPool
UnimodemQueueUserAPC
CallEnding
FreeOverStruct
UnimodemWriteFileEx
CallBeginning
UnimodemWaitCommEventEx

user32

GetSystemMetrics
DrawTextExW
GetWindowDC
WINNLSGetEnableStatus
UpdatePerUserSystemParameters
GetWindowRect
UserHandleGrantAccess
GetClientRect
MapWindowPoints
LoadImageW
CharLowerA
ShowWindowAsync
FindWindowA
LockWindowUpdate
SetWindowsHookExW
LoadIconA
SendMessageTimeoutW
GetDesktopWindow
HiliteMenuItem
GetSysColor
GetWindowTextA
FindWindowExW
SetProcessDefaultLayout
PrivateExtractIconExW
CreateDesktopA
FindWindowW
GetMenuItemID
GetWindowTextW
EnumDisplaySettingsExA
GetGuiResources
SetDlgItemInt

untfs

?AddExtent@NTFS_EXTENT_LIST@@QAEEVBIG_INT@@00@Z
??1NTFS_UPCASE_FILE@@UAE@XZ
?SetVolumeFlag@NTFS_SA@@QAEEGPAE@Z
?QueryAttributeByOrdinal@NTFS_FILE_RECORD_SEGMENT@@QAEEPAVNTFS_ATTRIBUTE@@PAEKK@Z
?CompareDupInfo@NTFS_MFT_INFO@@SGEPAXPAU_FILE_NAME@@@Z
??0NTFS_UPCASE_FILE@@QAE@XZ
?Initialize@NTFS_REFLECTED_MASTER_FILE_TABLE@@QAEEPAVNTFS_MASTER_FILE_TABLE@@@Z
?Initialize@NTFS_LOG_FILE@@QAEEPAVNTFS_MASTER_FILE_TABLE@@@Z
?Initialize@NTFS_EXTENT_LIST@@QAEEVBIG_INT@@0@Z
?Read@NTFS_MFT_FILE@@UAEEXZ
??1NTFS_FILE_RECORD_SEGMENT@@UAE@XZ
?Initialize@NTFS_CLUSTER_RUN@@QAEEPAVMEM@@PAVLOG_IO_DP_DRIVE@@VBIG_INT@@KK@Z
Extend
?Initialize@NTFS_FILE_RECORD_SEGMENT@@QAEEXZ
?Initialize@NTFS_BAD_CLUSTER_FILE@@QAEEPAVNTFS_MASTER_FILE_TABLE@@@Z
??0NTFS_CLUSTER_RUN@@QAE@XZ
?Initialize@NTFS_ATTRIBUTE_DEFINITION_TABLE@@QAEEPAVNTFS_MASTER_FILE_TABLE@@E@Z

glu32

gluPartialDisk
gluBeginSurface
gluNewNurbsRenderer
gluTessVertex
gluNewTess
gluNurbsCallback
gluEndTrim
gluTessNormal
gluSphere
gluUnProject
gluEndCurve
gluGetString
gluTessEndPolygon
gluErrorString
gluQuadricCallback
gluPickMatrix
gluQuadricDrawStyle
gluLoadSamplingMatrices
gluDeleteTess
gluPerspective
gluTessBeginPolygon
gluBuild2DMipmaps
gluLookAt
gluErrorUnicodeStringEXT
gluDeleteNurbsRenderer
gluNurbsProperty
gluTessCallback
gluScaleImage
gluQuadricTexture
gluQuadricNormals
gluBeginTrim
gluPwlCurve
gluDeleteQuadric
gluCylinder
gluNewQuadric

mapistub

MAPIUninitialize
MAPIAllocateMore@12
MAPILogoff
PropCopyMore@16
MAPIUninitialize@0
OpenStreamOnFile
FBadRowSet@4
HrGetOmiProvidersFlags
MAPIOpenFormMgr
LAUNCHWIZARD
MAPIGetDefaultMalloc@0
ScRelocNotifications@20
MNLS_lstrcpyW@8
EncodeID@12
ScCopyProps@16
MAPIFindNext
DeregisterIdleRoutine@4
FtMulDwDw@8
GetTnefStreamCodepage
ChangeIdleRoutine@28
UNKOBJ_ScCOReallocate@12
FBadPropTag@4
MNLS_lstrlenW@4
FtNegFt@8

kernel32

ConvertThreadToFiber
OpenJobObjectA
ExitProcess
VirtualAlloc
FindFirstVolumeA
VDMOperationStarted
WinExec
SetConsoleMode
DuplicateHandle
SetConsoleTitleW
SetMailslotInfo
GetComputerNameExW
ReadConsoleOutputA
FatalAppExitW
UnhandledExceptionFilter
SystemTimeToTzSpecificLocalTime
Heap32ListFirst
GetACP
HeapLock
ReadFile
GlobalDeleteAtom
GetProfileStringA
FindFirstVolumeMountPointA
RemoveDirectoryW
InterlockedExchangeAdd
GetThreadTimes
SetTapeParameters
SetCommState
GetSystemDefaultUILanguage
GetNextVDMCommand
GetFileTime
GetEnvironmentVariableA
TerminateProcess
lstrcatA
ProcessIdToSessionId
PrivMoveFileIdentityW
GetCurrentDirectoryA
SetCommBreak
GetUserDefaultLangID
GetCommConfig

msasn1

ASN1char32string_cmp
ASN1Free
ASN1_CreateModule
ASN1ztchar16string_cmp
ASN1BERDecNull
ASN1uint32_uoctets
ASN1BERDecUTCTime
ASN1CEREncChar32String
ASN1BEREncObjectIdentifier2
ASN1BEREncChar16String
ASN1_CloseModule
ASN1BEREncNull
ASN1char32string_free
ASN1BERDecBitString
ASN1BERDecU32Val
ASN1BEREncRemoveZeroBits
ASN1intx_uoctets
ASN1BERDecGeneralizedTime
ASN1BEREncObjectIdentifier
ASN1BEREncBitString
ASN1EncSetError
ASN1_CloseDecoder
ASN1BEREncOpenType
ASN1BERDecLength
ASN1BERDecU8Val
ASN1CEREncUTCTime
ASN1BEREncEndOfContents
ASN1BERDecOctetString
ASN1BERDotVal2Eoid
ASN1BERDecSXVal
ASN1BEREncChar32String
ASN1bitstring_cmp
ASN1_FreeEncoded
ASN1BERDecS8Val
ASN1BEREncTag
ASN1BERDecS16Val
ASN1BEREncLength
ASN1BERDecFlush
ASN1_Encode
ASN1BEREncDouble

w32topl

ToplVertexNumberOfOutEdges
ToplListAddElem
ToplHeapCreate
ToplIterFree
ToplGraphNumberOfVertices
ToplEdgeGetFromVertex
ToplHeapInsert
ToplVertexGetParent
ToplIsToplException
ToplListRemoveElem
ToplEdgeInit
ToplIterAdvance
ToplHeapExtractMin
ToplListFree
ToplFree
ToplGraphCreate
ToplIterGetObject
ToplGraphInit
ToplGraphSetVertexIter
ToplEdgeSetFromVertex
ToplEdgeAssociate
ToplHeapDestroy
ToplHeapIsEmpty
ToplVertexCreate
ToplEdgeGetWeight
ToplGraphDestroy

clusapi

RemoveClusterResourceNode
OfflineClusterGroup
GetClusterNetInterfaceState
ClusterRegOpenKey
GetClusterResourceKey
GetNodeClusterState
CreateClusterGroup
ClusterRegDeleteKey
ClusterControl
GetClusterNetworkId
OpenClusterNode
PauseClusterNode
GetClusterFromGroup
ClusterRegQueryValue
OpenClusterGroup
CloseClusterNotifyPort
GetClusterQuorumResource
ClusterRegGetKeySecurity
ClusterOpenEnum
CreateClusterResourceType
GetClusterNodeState
GetClusterGroupKey
OpenClusterNetInterface
ClusterGroupControl

fmifs

EnableVolumeCompression
QueryFileSystemName
QueryLatestFileSystemVersion
Format
ChkdskEx
QueryAvailableFileSystemFormat
FormatEx2
ComputeFmMediaType
FormatEx
QuerySupportedMedia
Extend

dsquery

DllRegisterServer
OpenQueryWindow
OpenSavedDsQueryW
DllGetClassObject
DllCanUnloadNow
OpenSavedDsQuery
DllInstall
DllUnregisterServer

psapi

EnumProcesses
GetModuleBaseNameW
GetModuleBaseNameA
GetDeviceDriverBaseNameA
EmptyWorkingSet
GetDeviceDriverFileNameA
GetMappedFileNameA
GetDeviceDriverBaseNameW
GetModuleInformation
InitializeProcessForWsWatch
QueryWorkingSet
GetModuleFileNameExW
GetWsChanges
GetMappedFileNameW
GetDeviceDriverFileNameW
EnumDeviceDrivers
GetModuleFileNameExA
EnumProcessModules
GetProcessMemoryInfo

traffic

TcGetFlowNameW
TcQueryInterface
TcDeregisterClient
TcQueryFlowA
TcDeleteFlow
TcQueryFlowW
TcRegisterClient
TcAddFilter
TcEnumerateFlows
TcDeleteFilter
TcGetFlowNameA
TcSetFlowA
TcSetFlowW
TcSetInterface
TcModifyFlow
TcOpenInterfaceA
TcOpenInterfaceW
TcEnumerateInterfaces
TcCloseInterface
TcAddFlow

dpnet

DllUnregisterServer
DllRegisterServer
DirectPlay8Create
DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 208KB - Virtual size: 208KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8167643435218efc93cf49ec995833c7

Headers

DLL Characteristics

File Characteristics

Imports

glmf32

rasmxs

msvcrt40

uniplat

user32

untfs

glu32

mapistub

kernel32

msasn1

w32topl

clusapi

fmifs

dsquery

psapi

traffic

dpnet

Sections

.text Size: 40KB - Virtual size: 39KB

.data Size: 208KB - Virtual size: 208KB

.reloc Size: 1024B - Virtual size: 912B

.text
Size: 40KB - Virtual size: 39KB

.data
Size: 208KB - Virtual size: 208KB

.reloc
Size: 1024B - Virtual size: 912B