danabot | 1011a741bec73841acc4c7f9c9b58492ab3a2a7a09bc2c3afeaea570d12c0ee8

Sharing

Copy URL Twitter E-mail

General

Target

1011a741bec73841acc4c7f9c9b58492ab3a2a7a09bc2c3afeaea570d12c0ee8
Size

6.0MB
MD5

e6ece3b3fbfd4ec6868c9d808239caae
SHA1

e1af7bc31d0064f312ed489ce20ffa55dd9abeb1
SHA256

1011a741bec73841acc4c7f9c9b58492ab3a2a7a09bc2c3afeaea570d12c0ee8
SHA512

73a3f58a5b74bf42cd50883034156f5426918dd9ea6a8851f08204721921f042d15696c4c89f4f81b3a3703686128aa7cbae7f68e10a035888a492f7407a5c88
SSDEEP

98304:Hz+i/ZUp+6iENc2cvrJvY6gQ4Qlixljx3pj3GWdF8E/vK1JVSP:Tpk+6nc2cvwZLGWD8E/S

Score

10^/10

danabot

Malware Config

Signatures

Danabot family
danabot

Files

1011a741bec73841acc4c7f9c9b58492ab3a2a7a09bc2c3afeaea570d12c0ee8
.dll windows x86

c732c329e9aa56de61734d21794cdbe0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

oleaut32

SysFreeString
SysReAllocStringLen
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopyInd
VariantCopy
VariantClear
VariantInit
CreateErrorInfo
GetErrorInfo
SetErrorInfo
SysFreeString

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
SetThreadToken
SetSecurityDescriptorDacl
ReportEventA
RegisterEventSourceA
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegFlushKey
RegCloseKey
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueW
LookupAccountSidW
LookupAccountNameW
IsValidSid
IsTextUnicode
InitializeSecurityDescriptor
InitializeAcl
GetUserNameW
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
GetSecurityDescriptorSacl
GetCurrentHwProfileW
FreeSid
EqualSid
DuplicateTokenEx
DuplicateToken
DeregisterEventSource
CreateProcessAsUserW
AllocateAndInitializeSid
AdjustTokenPrivileges
AddAccessAllowedAce
CryptEnumProvidersA
CryptSignHashA
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptGenKey
CryptReleaseContext
CryptAcquireContextW
CryptAcquireContextA
LsaFreeMemory
LsaClose
LsaRetrievePrivateData
LsaOpenPolicy
ConvertSidToStringSidA
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
StartServiceW
QueryServiceStatus
OpenServiceW
OpenSCManagerW
DeleteService
CreateServiceW
ControlService
CloseServiceHandle
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
CryptSignHashA
CryptVerifySignatureW
CryptDecrypt
CryptImportKey
CryptEncrypt
CryptDeriveKey
CryptDestroyKey
CryptExportKey
CryptGenKey
CryptReleaseContext
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptAcquireContextA
CreateWellKnownSid

user32

CharNextW
LoadStringW
SetWindowLongA
GetWindowLongA
SetWindowLongW
GetWindowLongW
CreateWindowExW
wvsprintfW
mouse_event
keybd_event
WindowFromPoint
UpdateWindow
UnregisterClassW
TranslateMessage
ToUnicodeEx
SystemParametersInfoW
ShowWindow
SetTimer
SetThreadDesktop
SetClipboardData
SendMessageA
SendMessageW
ScreenToClient
ReleaseDC
RegisterWindowMessageW
RegisterClassW
RealGetWindowClassW
PostThreadMessageW
PostMessageA
PostMessageW
PeekMessageW
OpenDesktopW
OpenClipboard
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjects
MessageBoxA
MessageBoxW
MenuItemFromPoint
MapVirtualKeyW
LoadStringW
LoadIconW
LoadCursorW
KillTimer
IsWindowVisible
IsWindow
InvalidateRect
GetWindowThreadProcessId
GetWindowTextW
GetWindowRect
GetWindowPlacement
GetWindowInfo
GetUserObjectInformationW
GetTopWindow
GetThreadDesktop
GetSystemMetrics
GetProcessWindowStation
GetWindow
GetMessageW
GetMenuItemID
GetKeyboardState
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetForegroundWindow
GetFocus
GetDesktopWindow
GetDC
GetCursorInfo
GetClipboardData
GetClassInfoW
FindWindowExW
FindWindowA
FindWindowW
EndDeferWindowPos
EmptyClipboard
DrawIcon
DispatchMessageW
DestroyWindow
DeferWindowPos
DefWindowProcW
CreateDesktopW
CloseClipboard
ChildWindowFromPoint
CharUpperBuffW
CharUpperW
CharLowerBuffW
BeginDeferWindowPos
AttachThreadInput
PrintWindow

kernel32

Sleep
VirtualFree
VirtualAlloc
lstrlenW
VirtualQuery
QueryPerformanceCounter
GetTickCount
GetSystemInfo
GetVersion
CompareStringW
IsValidLocale
SetThreadLocale
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetLocaleInfoW
WideCharToMultiByte
MultiByteToWideChar
GetACP
LoadLibraryExW
GetStartupInfoW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetCommandLineW
FreeLibrary
GetLastError
UnhandledExceptionFilter
RtlUnwind
RaiseException
ExitProcess
ExitThread
SwitchToThread
GetCurrentThreadId
CreateThread
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
FindFirstFileW
FindClose
SetCurrentDirectoryW
GetCurrentDirectoryW
WriteFile
GetStdHandle
CloseHandle
GetProcAddress
RaiseException
LoadLibraryA
GetLastError
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
LocalFree
LocalAlloc
FreeLibrary
lstrlenW
lstrcpyA
lstrcpyW
lstrcmpW
lstrcatW
WriteProcessMemory
WritePrivateProfileStringW
WriteFile
WideCharToMultiByte
WaitForSingleObjectEx
WaitForSingleObject
WaitForMultipleObjectsEx
VirtualQueryEx
VirtualQuery
VirtualProtect
VirtualFreeEx
VirtualFree
VirtualAllocEx
VirtualAlloc
VerSetConditionMask
VerifyVersionInfoW
UnmapViewOfFile
UnlockFileEx
UnlockFile
TryEnterCriticalSection
TerminateThread
TerminateProcess
SystemTimeToFileTime
SwitchToThread
SuspendThread
Sleep
SetThreadPriority
SetPriorityClass
SetLastError
SetFileTime
SetFilePointerEx
SetFilePointer
SetFileAttributesW
SetEvent
SetEndOfFile
SetCurrentDirectoryW
ResumeThread
ResetEvent
RemoveDirectoryW
ReleaseSemaphore
ReadProcessMemory
ReadFile
RaiseException
QueryPerformanceFrequency
QueryPerformanceCounter
QueryDosDeviceW
IsDebuggerPresent
OutputDebugStringA
OutputDebugStringW
OpenProcess
OpenEventW
MultiByteToWideChar
MapViewOfFile
LockFileEx
LockFile
LocalFree
LocalAlloc
LoadLibraryA
LoadLibraryW
LeaveCriticalSection
LCMapStringW
IsValidLocale
IsBadReadPtr
InitializeCriticalSection
HeapValidate
HeapSize
HeapReAlloc
HeapFree
HeapDestroy
HeapCreate
HeapCompact
HeapAlloc
GlobalUnlock
GlobalSize
GlobalMemoryStatusEx
GlobalMemoryStatus
GlobalLock
GlobalFree
GlobalAlloc
GetWindowsDirectoryW
GetVolumeInformationW
GetVersionExA
GetVersionExW
GetVersion
GetUserDefaultLangID
GetTimeZoneInformation
GetTickCount
GetThreadPriority
GetThreadLocale
GetTempPathA
GetTempPathW
GetTempFileNameW
GetSystemTimeAsFileTime
GetSystemTime
GetSystemPowerStatus
GetSystemInfo
GetSystemDirectoryW
GetSystemDefaultLangID
GetStdHandle
GetLongPathNameW
GetShortPathNameW
GetProcessHeap
GetProcAddress
GetPrivateProfileStringW
GetPrivateProfileIntW
GetModuleHandleA
GetModuleHandleW
GetModuleFileNameW
GetLogicalDrives
GetLogicalDriveStringsW
GetLocaleInfoW
GetLocalTime
GetLastError
GetFullPathNameA
GetFullPathNameW
GetFileType
GetFileSize
GetFileAttributesExW
GetFileAttributesA
GetFileAttributesW
GetExitCodeThread
GetExitCodeProcess
GetEnvironmentVariableW
GetDriveTypeW
GetDiskFreeSpaceExW
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetDateFormatW
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetCurrentDirectoryW
GetComputerNameW
GetCPInfoExW
GetCPInfo
GetBinaryTypeW
GetACP
FreeLibrary
FormatMessageA
FormatMessageW
FlushViewOfFile
FlushInstructionCache
FlushFileBuffers
FlushConsoleInputBuffer
FindNextFileA
FindNextFileW
FindFirstFileA
FindFirstFileW
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
FileTimeToDosDateTime
ExitThread
ExitProcess
EnumSystemLocalesW
EnumCalendarInfoW
EnterCriticalSection
DisconnectNamedPipe
DeleteFileA
DeleteFileW
DeleteCriticalSection
CreateThread
CreateSemaphoreA
CreateRemoteThread
CreateProcessW
CreateNamedPipeW
CreateMutexW
CreateFileMappingW
CreateFileA
CreateFileW
CreateEventA
CreateEventW
CreateDirectoryW
CopyFileW
ConnectNamedPipe
CompareStringW
CloseHandle
AreFileApisANSI
Sleep
Wow64EnableWow64FsRedirection
Wow64DisableWow64FsRedirection

gdi32

StretchBlt
SetStretchBltMode
SelectObject
Rectangle
GetStockObject
GetPixel
GetObjectA
GetObjectW
GetDeviceCaps
GetDIBits
DeleteObject
DeleteDC
CreatePen
CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

mpr

WNetOpenEnumW
WNetEnumResourceW
WNetCloseEnum

netapi32

NetApiBufferFree
NetWkstaGetInfo
NetApiBufferFree
NetUserEnum

ole32

OleInitialize
CreateBindCtx
MkParseDisplayName
CoGetObject
CoTaskMemFree
IIDFromString
CLSIDFromString
StringFromCLSID
CoCreateInstance
CoUninitialize
CoInitializeEx
CoInitialize

ws2_32

WSAIoctl
WSAEventSelect
WSAGetLastError
WSASetLastError
WSACleanup
WSAStartup
getservbyname
gethostbyname
socket
shutdown
setsockopt
send
select
recv
ntohs
ntohl
listen
inet_addr
htons
htonl
getsockopt
getsockname
ioctlsocket
connect
closesocket
bind
accept
__WSAFDIsSet

shell32

ShellExecuteExW
SHAppBarMessage
SHGetFolderPathW
SHGetSpecialFolderPathW
SHGetSpecialFolderPathW
SHGetPathFromIDListW
SHGetSpecialFolderLocation

wininet

InternetSetOptionW
InternetCrackUrlW

msvcrt

_errno
memchr
strcmp
strerror
realloc
_ftol
strncpy
strcat
isdigit
isxdigit
memmove
printf
tolower
isupper
isspace
memcmp
free
malloc
atol
_stricmp
strchr
strncmp
memset
strlen
memcpy
toupper
abort
signal
_getch
setvbuf
getenv
strstr
sprintf
_exit
raise
_vsnprintf
wcsstr
strtol
fflush
fputs
time
fwrite
strrchr
strtoul
sscanf
fprintf
_stat
ftell
fread
fopen
_lseek
_write
_read
_close
wcslen
_getpid
isalnum
localtime
gmtime
calloc
_chmod
_fdopen
_open
fclose
qsort
fseek
_strnicmp
fgets
_setmode
_wfopen
memset
memmove
memcpy
_beginthreadex

esent

JetIndexRecordCount
JetMove
JetRetrieveColumns
JetOpenTableW
JetOpenDatabaseW
JetGetColumnInfoW
JetAttachDatabaseW
JetEndSession
JetBeginSessionW
JetSetSystemParameterW
JetTerm
JetCreateInstanceW
JetInit

crypt32

CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CertCreateSelfSignCertificate
CertOpenSystemStoreW
CertGetNameStringW
CertStrToNameW
CertNameToStrW
CryptExportPKCS8
CryptAcquireCertificatePrivateKey
CryptExportPublicKeyInfoEx
CryptSignAndEncodeCertificate
CertAddCertificateContextToStore
CertGetCertificateContextProperty
CertFreeCertificateContext
CertCreateCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CryptEncodeObject
PFXExportCertStoreEx
CryptBinaryToStringA

wsock32

__WSAFDIsSet
send
recv

iphlpapi

GetAdaptersInfo

winmm

mmioStringToFOURCCW

winspool.drv

GetDefaultPrinterW

rasapi32

RasGetEntryDialParamsA
RasEnumEntriesA

cryptui

CryptUIDlgViewCertificateW

avifil32

AVIFileRelease
AVIStreamRelease
AVIStreamWrite
AVIMakeCompressedStream
AVIStreamSetFormat
AVIFileCreateStreamW
AVIFileOpenW
AVIFileExit
AVIFileInit

shlwapi

StrStrW

ntdll

RtlCompressBuffer
RtlGetCompressionWorkSpaceSize
LdrEnumerateLoadedModules
RtlReleasePebLock
RtlAcquirePebLock
RtlGetCurrentPeb
NtFreeVirtualMemory
NtAllocateVirtualMemory
NtQueryValueKey
NtEnumerateValueKey
NtOpenKey
RtlQueryElevationFlags
NtQueryInformationToken
NtOpenProcessToken
RtlGetVersion
RtlDestroyHeap
RtlFreeHeap
RtlAllocateHeap
RtlCreateHeap
RtlNtStatusToDosError
RtlEqualUnicodeString
RtlInitUnicodeString
NtClose
RtlAllocateHeap

Exports

Exports

TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr

Sections

.text
Size: 5.1MB - Virtual size: 5.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 606KB - Virtual size: 606KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 1.1MB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didata
Size: 1024B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 150B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 282KB - Virtual size: 282KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c732c329e9aa56de61734d21794cdbe0

Headers

File Characteristics

Imports

oleaut32

advapi32

user32

kernel32

gdi32

version

mpr

netapi32

ole32

ws2_32

shell32

wininet

msvcrt

esent

crypt32

wsock32

iphlpapi

winmm

winspool.drv

rasapi32

cryptui

avifil32

shlwapi

ntdll

Exports

Exports

Sections

.text Size: 5.1MB - Virtual size: 5.1MB

.itext Size: 5KB - Virtual size: 5KB

.data Size: 606KB - Virtual size: 606KB

.bss Size: - Virtual size: 1.1MB

.idata Size: 19KB - Virtual size: 18KB

.didata Size: 1024B - Virtual size: 912B

.edata Size: 512B - Virtual size: 150B

.rdata Size: 512B - Virtual size: 68B

.reloc Size: 282KB - Virtual size: 282KB

.rsrc Size: 21KB - Virtual size: 21KB

.text
Size: 5.1MB - Virtual size: 5.1MB

.itext
Size: 5KB - Virtual size: 5KB

.data
Size: 606KB - Virtual size: 606KB

.bss
Size: - Virtual size: 1.1MB

.idata
Size: 19KB - Virtual size: 18KB

.didata
Size: 1024B - Virtual size: 912B

.edata
Size: 512B - Virtual size: 150B

.rdata
Size: 512B - Virtual size: 68B

.reloc
Size: 282KB - Virtual size: 282KB

.rsrc
Size: 21KB - Virtual size: 21KB