d8a084dafbcbd1bf7816e6414d271324714306c5afdb4d73a7c3b56322093e46

Sharing

Copy URL Twitter E-mail

General

Target

d8a084dafbcbd1bf7816e6414d271324714306c5afdb4d73a7c3b56322093e46
Size

378KB
MD5

140ad92dbabe50aae7c5d7f1bc664a0c
SHA1

4364366ce232b3e32097504b3291643d1ebde6d3
SHA256

d8a084dafbcbd1bf7816e6414d271324714306c5afdb4d73a7c3b56322093e46
SHA512

3db707ae1e7a1209faeb5b6b720a3d5a713c49fe4f7511189eb90a309c78f74d25180d84f210c89f974aa6c8597e0fd922ee2bf5916a1a761cc1362b2ee1136c
SSDEEP

6144:AH/4/Sml2QjyGW8GEu72qXaschAN1aUbzZdYVOd2Lvzp70yuaEaYKwISxn:AQCQObLlLKscy37YY2Lvzp7FufhKg

Score

N/A

Malware Config

Signatures

Files

d8a084dafbcbd1bf7816e6414d271324714306c5afdb4d73a7c3b56322093e46
.exe windows x86

715a008a825540221cbf61b46fc53a51

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlCreateUserProcess
RtlIntegerToUnicodeString
ZwReadRequestData
RtlDeleteElementGenericTable
ZwRegisterThreadTerminatePort
NtWriteFile
RtlEqualPrefixSid
ZwDuplicateObject
ZwQueryVolumeInformationFile
NtQueryEaFile
RtlAllocateAndInitializeSid
NtGetWriteWatch
ZwOpenEventPair
DbgUiGetThreadDebugObject
RtlGetAce
ZwQuerySystemTime
RtlSubtreePredecessor
ZwClose
ZwOpenIoCompletion
RtlRandom
ZwSetIoCompletion
ZwSetContextThread
RtlOpenCurrentUser
NtNotifyChangeMultipleKeys
RtlInterlockedFlushSList
RtlDosSearchPath_U
NtCreateMailslotFile
RtlDestroyProcessParameters
memcpy
DbgUiDebugActiveProcess
NtAccessCheck
NtAllocateLocallyUniqueId
RtlIntegerToChar
ZwVdmControl
ZwCreateSection
strtol
RtlAppendStringToString
RtlAddAccessDeniedAceEx
RtlTimeToElapsedTimeFields
ZwSetSystemPowerState
NtWaitForKeyedEvent
RtlInt64ToUnicodeString
RtlLookupElementGenericTableAvl
NtQuerySecurityObject
RtlPushFrame

ws2_32

getservbyname
WSAAsyncGetProtoByNumber
ntohl
WSANtohl
WSAStartup
WSADuplicateSocketW
closesocket
WSAGetServiceClassInfoA
WSAGetLastError
WSACancelBlockingCall
WSALookupServiceBeginA
WSCInstallProvider
WSCEnableNSProvider
WSAProviderConfigChange
getnameinfo
WSAAddressToStringW
inet_ntoa
WSAUnhookBlockingHook
WSAGetQOSByName
WSAHtons
WPUCompleteOverlappedRequest
WSAAsyncGetServByPort
WSAGetServiceClassNameByClassIdW
gethostname
WSALookupServiceNextA
WSCEnumProtocols
inet_addr
WSAAsyncGetServByName
WSAInstallServiceClassW
WSAEnumProtocolsA
WSASocketW
WSACreateEvent
WSCGetProviderPath
WSANSPIoctl
sendto
WSCWriteNameSpaceOrder
connect
WSARecvFrom
WSAEnumNameSpaceProvidersA
WSAAddressToStringA
WSASetServiceW
WSAIoctl
WSASetServiceA
getpeername
ioctlsocket

clbcatq

CheckMemoryGates
GetCatalogObject2
ServerGetApplicationType
InprocServer32FromString
DllGetClassObject
SetSetupSave
SetupOpen
ActivatorUpdateForIsRouterChanges
CLSIDFromStringByBitness
DeleteAllActivatorsForClsid
ComPlusMigrate
OpenComponentLibraryEx
CreateComponentLibraryEx
SetupSave
DowngradeAPL
GetComputerObject
CoRegCleanup
GetCatalogObject
UpdateFromAppChange
OpenComponentLibraryOnMemEx
OpenComponentLibraryOnStreamEx
SetSetupOpen
UpdateFromComponentChange
GetSimpleTableDispenser

kernel32

EnumerateLocalComputerNamesA
EndUpdateResourceW
GetPrivateProfileStructA
GlobalUnlock
EnumDateFormatsW
GetEnvironmentVariableA
VirtualAllocEx
QueryDosDeviceW
ConnectNamedPipe
VirtualAlloc
GetCommProperties
SetConsoleWindowInfo
MapViewOfFile
GetCurrentThread
GetStringTypeExW
PrepareTape
EnumSystemLocalesW
ProcessIdToSessionId
lstrcpyW
FindNextVolumeA
DebugSetProcessKillOnExit
GetConsoleHardwareState
SetConsoleInputExeNameW
GetConsoleAliasesLengthW
LocalAlloc
GetModuleFileNameA
CompareStringW
GetVolumePathNameW
GetVolumeInformationA
TermsrvAppInstallMode
LoadLibraryA
GetStringTypeW
GetHandleContext
EnumSystemCodePagesA
ReplaceFileA
SetConsoleTitleW
SetConsoleTextAttribute
DeleteTimerQueueEx
GetSystemPowerStatus
GetEnvironmentStringsW
QueryPerformanceCounter
LocalLock
OpenFileMappingW
TlsFree

msvcrt40

__p__acmdln
frexp
__doserrno
towlower
_waccess
_control87
?stossc@streambuf@@QAEXXZ
??Bios@@QBEPAXXZ
cosh
?getline@istream@@QAEAAV1@PACHD@Z
memmove
_filbuf
?getline@istream@@QAEAAV1@PADHD@Z
??1ostrstream@@UAE@XZ
wcsncpy
_j1
??6ostream@@QAEAAV0@P6AAAVios@@AAV1@@Z@Z
_mbsspn
??1ofstream@@UAE@XZ
_strrev
_cwait
wcspbrk
_clearfp
_wsystem
_rmdir
_getws
?close@fstream@@QAEXXZ
_ismbchira
?binary@filebuf@@2HB
?close@ifstream@@QAEXXZ
_logb
_spawnle
_chdir
??_E__non_rtti_object@@UAEPAXI@Z
_dup
??0ios@@IAE@XZ
_seterrormode
_yn
?tie@ios@@QBEPAVostream@@XZ
_wasctime
?read@istream@@QAEAAV1@PACH@Z
??5istream@@QAEAAV0@AAK@Z

odbcjt32

SQLProcedureColumnsW
SQLGetTypeInfoW
SQLNumResultCols
AdvancedDialogProc
InitializeLoginDialog
SQLPrepareW
SQLMoreResults
SQLSetConnectAttrW
SQLAllocConnect
SQLNumParams
SQLSetScrollOptions
SelectUIdxDlgProc
SQLGetCursorNameW
SQLExecDirectW
SQLSetCursorNameW
SQLBulkOperations
SQLGetDescFieldW
SQLEndTran
DefTxtFmtDlgProc
SQLColumnsW
RepairCompactProc
SQLSetDescFieldW
SQLNativeSqlW
SQLExecute
SQLFreeConnect
InvisibleSelectDb
LoginDialogProc
InitDialogAgain
ConfigDialogProc
ConfigDSNW
SQLGetConnectAttrW
SQLFetch
OpenDirHook

Sections

.text
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 123KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 628KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 171KB - Virtual size: 171KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

715a008a825540221cbf61b46fc53a51

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

ws2_32

clbcatq

kernel32

msvcrt40

odbcjt32

Sections

.text Size: 81KB - Virtual size: 81KB

.rdata Size: 123KB - Virtual size: 123KB

.data Size: 1KB - Virtual size: 628KB

.rsrc Size: 171KB - Virtual size: 171KB

.reloc Size: 1024B - Virtual size: 1024B

.text
Size: 81KB - Virtual size: 81KB

.rdata
Size: 123KB - Virtual size: 123KB

.data
Size: 1KB - Virtual size: 628KB

.rsrc
Size: 171KB - Virtual size: 171KB

.reloc
Size: 1024B - Virtual size: 1024B