6e689a29f4d11d212cce715c8085c743f8c6375c15a7080afd03ed3d9c003f84

Sharing

Copy URL Twitter E-mail

General

Target

6e689a29f4d11d212cce715c8085c743f8c6375c15a7080afd03ed3d9c003f84
Size

396KB
MD5

8eb2f3c1b478ba0bbbf7140abf6226bd
SHA1

4b7bc296abd7637819f1238f5bee65f7a48c9b44
SHA256

6e689a29f4d11d212cce715c8085c743f8c6375c15a7080afd03ed3d9c003f84
SHA512

9c190fd335d0d670e36de4bce33ea7f21735d388819dbde4d98cf6ffd568b25a943b71482d9b9be092dd98d1e921f1546b08e3320c1b55e961efd5c061367535
SSDEEP

6144:VJ+QiY3VBOLgXzsw3rUimCEsn68XWXke/5d:VJ+SVUgX4z664q/5d

Score

N/A

Malware Config

Signatures

Files

6e689a29f4d11d212cce715c8085c743f8c6375c15a7080afd03ed3d9c003f84
.dll windows x86

882d3f85de116e06c5492ccd0e77aca7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSAJoinLeaf
WSAAccept
WSARecv
WSASend
WSAGetOverlappedResult
WSARecvFrom
WSASendTo
WSASocketW
WSASocketA
inet_addr
htonl
WSAGetLastError
ioctlsocket
WSAConnect
gethostname
select
getpeername
getsockname
bind
getsockopt
setsockopt
accept
listen
closesocket
sendto
send
recvfrom
recv
connect
socket
WSAStartup
ntohl
inet_ntoa
htons
ntohs

mswsock

AcceptEx
WSARecvEx
GetAcceptExSockaddrs

kernel32

VirtualQuery
MapViewOfFile
CreateFileMappingA
GetFileSize
CreateFileA
UnmapViewOfFile
IsBadReadPtr
GetWindowsDirectoryA
SetFileAttributesA
CreateDirectoryA
CopyFileA
GetSystemDirectoryA
LoadLibraryA
DeleteFileA
FreeLibrary
SetCurrentDirectoryA
GetCurrentDirectoryA
ReadProcessMemory
LoadLibraryExA
LoadLibraryW
LoadLibraryExW
FreeResource
SetFileTime
SystemTimeToFileTime
WriteFile
SetFilePointer
SizeofResource
LockResource
LoadResource
FindResourceA
ReadFile
CreateEventA
SetEvent
lstrcmpiA
lstrcpynA
lstrcmpA
VirtualFree
VirtualAlloc
GetStdHandle
GetLocalTime
SetLastError
FlushInstructionCache
WriteProcessMemory
VirtualProtectEx
VirtualAllocEx
SetThreadContext
GetThreadContext
TerminateThread
GetExitCodeThread
GetCurrentThreadId
GetCurrentThread
GlobalDeleteAtom
GlobalLock
InterlockedIncrement
InterlockedDecrement
LocalFree
LocalAlloc
TlsAlloc
GlobalUnlock
GlobalHandle
TlsFree
GlobalReAlloc
TlsSetValue
LocalReAlloc
TlsGetValue
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
lstrcatA
GetVersion
SetErrorMode
GlobalFlags
WritePrivateProfileStringA
GetProcessVersion
FlushFileBuffers
GetSystemInfo
GetCPInfo
GetOEMCP
RtlUnwind
HeapFree
HeapAlloc
SetStdHandle
GetFileType
GetCommandLineA
ExitProcess
ExitThread
RaiseException
HeapSize
HeapReAlloc
GetACP
LCMapStringA
LCMapStringW
HeapDestroy
HeapCreate
IsBadWritePtr
SetHandleCount
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
IsBadCodePtr
Module32First
Module32Next
GetCurrentProcess
CreateThread
SetThreadPriority
CreateToolhelp32Snapshot
OpenProcess
GetExitCodeProcess
TerminateProcess
GetModuleHandleA
GetProcAddress
SuspendThread
MultiByteToWideChar
ResumeThread
GetLastError
GetModuleFileNameA
GetVersionExA
Sleep
GetCurrentProcessId
OpenMutexA
GetTickCount
ReleaseMutex
CloseHandle
GlobalFree
DeleteCriticalSection
CreateMutexA
InitializeCriticalSection
EnterCriticalSection
GlobalAlloc
LeaveCriticalSection
WideCharToMultiByte
WaitForSingleObject
CreateProcessW
CreateProcessA
lstrlenA
lstrcpyA
SetEndOfFile
VirtualProtect
CreateRemoteThread

user32

ClientToScreen
GetDC
ReleaseDC
TabbedTextOutA
DrawTextA
GrayStringA
GetSystemMetrics
GetWindowRect
GetWindowPlacement
IsIconic
SystemParametersInfoA
RegisterWindowMessageA
SetWindowPos
SetWindowLongA
GetWindow
GetForegroundWindow
GetMessagePos
GetMessageTime
RemovePropA
CallWindowProcA
GetPropA
SetPropA
GetClassLongA
DestroyWindow
GetDlgCtrlID
GetWindowTextA
GetDlgItem
GetMenuItemID
GetSubMenu
GetMenuItemCount
GetMenu
RegisterClassA
WinHelpA
GetCapture
GetTopWindow
CopyRect
GetClientRect
AdjustWindowRectEx
SetFocus
GetSysColor
MapWindowPoints
LoadIconA
ShowWindow
UnregisterClassA
GetClassNameA
PtInRect
LoadCursorA
GetSysColorBrush
LoadStringA
DestroyMenu
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
GetKeyState
ValidateRect
IsWindowVisible
PeekMessageA
GetCursorPos
GetParent
GetLastActivePopup
IsWindowEnabled
GetWindowLongA
SetCursor
SendMessageA
PostMessageA
EnableWindow
wsprintfA
GetClassInfoA
DefWindowProcA
PostThreadMessageA
CreateWindowExA
GetDesktopWindow
SetForegroundWindow
MessageBoxA
PostQuitMessage
SetTimer
FindWindowExA
SetWindowTextA
UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx
KillTimer
WaitMessage
GetMenuCheckMarkDimensions
ReleaseCapture

gdi32

DeleteDC
GetDeviceCaps
GetObjectA
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
SaveDC
RestoreDC
SelectObject
GetStockObject
SetBkColor
SetTextColor
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
DeleteObject
CreateBitmap

winspool.drv

DocumentPropertiesA
ClosePrinter
OpenPrinterA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyA
RegEnumKeyA
RegOpenKeyA
RegCreateKeyExA
RegCloseKey

comctl32

ord17

ole32

CoGetClassObject
CoCreateInstance

imagehlp

ImageDirectoryEntryToData

wsock32

WSAAsyncSelect
shutdown
WSACleanup
WSASetLastError
gethostbyname

winmm

timeKillEvent
timeSetEvent

Exports

Exports

FNS_AddHost
FNS_EmptyHost
FNS_GameBegin
FNS_GameEnd
FNS_GetDPlaySvrHandle
FNS_GetGamePlayState
FNS_GetLocalGamePort
FNS_GetVersion
FNS_ModifyPlayFlag
FNS_ModifyProxyIp
FNS_ModifySwitchPort
FNS_RemoveBannedLocalPort
FNS_RemoveHost
FNS_SetCSLocalHostInfo
FNS_SetCurrentPath
FNS_SetDPlaySvrHandle
FNS_SetData
FNS_SetDataCallbackFunc
FNS_SetGameParam
FNS_SetGamePlayState
FNS_SetGamePrivilege
FNS_SetGameProcessName
FNS_SetInSameWall
FNS_SetLocalHostInfo
FNS_SetNetCtrlFlag
FNS_SetProxy
FNS_SetRemovedSocket
FNS_SetRoomInfo
FNS_SetSwitchInfo
HFHL_GetEntityAPI1
HFHL_GetEntityAPI2
HFHL_SetGameInfo

Sections

.text
Size: 160KB - Virtual size: 157KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Shared
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 152KB - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

882d3f85de116e06c5492ccd0e77aca7

Headers

File Characteristics

Imports

ws2_32

mswsock

kernel32

user32

gdi32

winspool.drv

advapi32

comctl32

ole32

imagehlp

wsock32

winmm

Exports

Exports

Sections

.text Size: 160KB - Virtual size: 157KB

.rdata Size: 32KB - Virtual size: 28KB

.data Size: 12KB - Virtual size: 37KB

Shared Size: 16KB - Virtual size: 15KB

.rsrc Size: 152KB - Virtual size: 151KB

.reloc Size: 20KB - Virtual size: 18KB

.text
Size: 160KB - Virtual size: 157KB

.rdata
Size: 32KB - Virtual size: 28KB

.data
Size: 12KB - Virtual size: 37KB

Shared
Size: 16KB - Virtual size: 15KB

.rsrc
Size: 152KB - Virtual size: 151KB

.reloc
Size: 20KB - Virtual size: 18KB