b4e1516d6333b209e3329f06249e53634de2f6a426a30dc57c160e84019559d6

Sharing

Copy URL Twitter E-mail

General

Target

b4e1516d6333b209e3329f06249e53634de2f6a426a30dc57c160e84019559d6
Size

191KB
MD5

4d15de2b30945b3402fe8f03b18197fd
SHA1

8678098b24f99b7a9b03ca920338e828061533f2
SHA256

b4e1516d6333b209e3329f06249e53634de2f6a426a30dc57c160e84019559d6
SHA512

10236af143e03f927300f86f6c21a33c1598167a7ea5f5a9c3d42cb6ee9f6ea5cca34f06fa6f4770082c96aa4df5e367e2db76a4af722db4b8a573018e13a517
SSDEEP

3072:6k6Wr77Ia6DXaIHNcwGoWkwEJcOBH0ANfzRegefOwxWoz:65Wr77Ia6jaIHilkNJcqUApRegefOv

Score

N/A

Malware Config

Signatures

Files

b4e1516d6333b209e3329f06249e53634de2f6a426a30dc57c160e84019559d6
.dll windows x86

46aea8fed0c790bce7b7f61ee1a0be82

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memmove
sprintf
wcslen
isprint

ntdll

RtlAnsiStringToUnicodeString
NtCreateFile
RtlIntegerToUnicodeString
RtlInitUnicodeString
RtlAllocateHeap
RtlInitString
RtlReAllocateHeap
RtlCopyUnicodeString
NtDeviceIoControlFile
RtlNtStatusToDosError
RtlFreeHeap
NtClose
NtWaitForSingleObject
RtlFreeUnicodeString
RtlInitAnsiString
NtOpenFile

kernel32

DisableThreadLibraryCalls
QueryPerformanceCounter
GetTickCount
VirtualProtect
GetCurrentProcessId
CreateFileMappingW
UnmapViewOfFile
VirtualAlloc
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
lstrlenW
InterlockedIncrement
InterlockedDecrement
GetLastError
GetComputerNameA
HeapFree
CloseHandle
MapViewOfFile
GetSystemTimeAsFileTime

advapi32

ReportEventW
RegisterEventSourceA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
DeregisterEventSource
RegQueryValueExW
ReportEventA
RegOpenKeyExW

iphlpapi

GetIcmpStatistics
GetUdpStatistics
GetTcpStatistics
GetIpStatistics
GetNumberOfInterfaces
GetIfTable

Exports

Exports

ServiceMain
CloseIPXPerformanceData
CloseNWNBPerformanceData
CloseNbfPerformanceData
CloseSPXPerformanceData
CloseTcpIpPerformanceData
CollectDhcpPerformanceData
CollectIPXPerformanceData
CollectNWNBPerformanceData
CollectNbfPerformanceData
CollectSPXPerformanceData
CollectTcpIpPerformanceData
OpenDhcpPerformanceData
OpenIPXPerformanceData
OpenNWNBPerformanceData
OpenNbfPerformanceData
OpenSPXPerformanceData
OpenTcpIpPerformanceData

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 165KB - Virtual size: 165KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

46aea8fed0c790bce7b7f61ee1a0be82

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

kernel32

advapi32

iphlpapi

Exports

Exports

Sections

.text Size: 16KB - Virtual size: 16KB

.data Size: 6KB - Virtual size: 6KB

.rsrc Size: 165KB - Virtual size: 165KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 16KB - Virtual size: 16KB

.data
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 165KB - Virtual size: 165KB

.reloc
Size: 2KB - Virtual size: 1KB