sonmas[.]dat | Triage

Sharing

Copy URL Twitter E-mail

General

Target

sonmas.dat
Size

323KB
MD5

5f8d6c8f5769082363b8d37dec73d5a1
SHA1

08ab0c5761c56b8ec139f48f731e907b64db94a1
SHA256

02197bd49f30b8aa57585140b3f91365fe7f1e306b754d6ad07552bc9f88e7b9
SHA512

e9d41c1a60f635630a3dbbe1c059b9c78745c2cbdfddc314686b795bfe16539cf50686f68f9a0f306fcf8ec91cc090bf73886d34e374f6fd756fd8eb0cc2abb1
SSDEEP

6144:ABXaa4/Vnx7cYGSriggFBFsHLnSAdOUh2RPF8L/:VpxoPcrJnS3Uh2RPF8L/

Score

N/A

Malware Config

Signatures

Files

sonmas.dat
.dll windows x64

88acb35eda01b8669f5b68b19160e655

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

CloseHandle
CreateFileMappingA
DeleteCriticalSection
EnterCriticalSection
GetFileAttributesA
GetFileAttributesExA
GetFullPathNameA
GetLastError
GetLongPathNameA
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetTempPathA
GetWindowsDirectoryA
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
MapViewOfFile
MultiByteToWideChar
Sleep
TlsGetValue
UnmapViewOfFile
VirtualProtect
VirtualQuery

msvcrt

___lc_codepage_func
___mb_cur_max_func
__iob_func
_access
_amsg_exit
_assert
_chmod
_close
_errno
_fdopen
_findclose
_findfirst64
_findnext64
_fullpath
_get_osfhandle
_initterm
_lock
_locking
_mbsrchr
_mkdir
_open
_read
_rmdir
_sopen
_stat64
_strdup
_time64
_unlink
_unlock
abort
atoi
calloc
fclose
fflush
free
fwrite
getc
getenv
isalpha
islower
isspace
isupper
isxdigit
_write
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
perror
qsort
realloc
rand
rename
srand
strcat
strchr
strcmp
strcpy
strerror
strlen
strncat
strncmp
strncpy
strpbrk
strrchr
strstr
strtol
strtoul
tolower
ungetc
vfprintf

Exports

Exports

hcAtomicCreate
hcAtomicDeleteNew
hcAtomicDestroy
hcAtomicLock
hcAtomicNewFile
hcAtomicOrigFile
hcAtomicReplaceOrig
hcAtomicUnlock
hcBlanksAdd
hcBlanksCreate
hcBlanksDestroy
hcBlanksIsMember
hcCacheCopySet
hcCacheCreateTagFile
hcCacheDir
hcCacheNumFont
hcCacheNumSubdir
hcCacheSubdir
hcCharSetAddChar
hcCharSetCopy
hcCharSetCount
hcCharSetCoverage
hcCharSetCreate
hcCharSetDelChar
hcCharSetDestroy
hcCharSetEqual
hcCharSetFirstPage
hcCharSetHasChar
hcCharSetIntersect
hcCharSetIntersectCount
hcCharSetIsSubset
hcCharSetMerge
hcCharSetNew
hcCharSetNextPage
hcCharSetSubtract
hcCharSetSubtractCount
hcCharSetUnion
hcConfigAppFontAddDir
hcConfigAppFontAddFile
hcConfigAppFontClear
hcConfigBuildFonts
hcConfigCreate
hcConfigDestroy
hcConfigEnableHome
hcConfigFileInfoIterGet
hcConfigFileInfoIterInit
hcConfigFileInfoIterNext
hcConfigFilename
hcConfigGetBlanks
hcConfigGetCache
hcConfigGetCacheDirs
hcConfigGetConfigDirs
hcConfigGetConfigFiles
hcConfigGetCurrent
hcConfigGetFilename
hcConfigGetFontDirs
hcConfigGetFonts
hcConfigGetRescanInterval
hcConfigGetRescanInverval
hcConfigGetSysRoot
hcConfigHome
hcConfigParseAndLoad
hcConfigParseAndLoadFromMemory
hcConfigReference
hcConfigSetCurrent
hcConfigSetRescanInterval
hcConfigSetRescanInverval
hcConfigSetSysRoot
hcConfigSubstitute
hcConfigSubstituteWithPat
hcConfigUptoDate
hcDefaultSubstitute
hcDirCacheClean
hcDirCacheCreateUUID
hcDirCacheDeleteUUID
hcDirCacheLoad
hcDirCacheLoadFile
hcDirCacheRead
hcDirCacheRescan
hcDirCacheUnlink
hcDirCacheUnload
hcDirCacheValid
hcDirSave
hcDirScan
hcFileIsDir
hcFileScan
hcFini
hcFontList
hcFontMatch
hcFontRenderPrepare
hcFontSetAdd
hcFontSetCreate
hcFontSetDestroy
hcFontSetList
hcFontSetMatch
hcFontSetPrint
hcFontSetSort
hcFontSetSortDestroy
hcFontSort
hcFreeTypeCharIndex
hcFreeTypeCharSet
hcFreeTypeCharSetAndSpacing
hcFreeTypeQuery
hcFreeTypeQueryAll
hcFreeTypeQueryFace
hcGetDefaultLangs
hcGetLangs
hcGetVersion
hcInit
hcInitBringUptoDate
hcInitLoadConfig
hcInitLoadConfigAndFonts
hcInitReinitialize
hcLangGetCharSet
hcLangNormalize
hcLangSetAdd
hcLangSetCompare
hcLangSetContains
hcLangSetCopy
hcLangSetCreate
hcLangSetDel
hcLangSetDestroy
hcLangSetEqual
hcLangSetGetLangs
hcLangSetHasLang
hcLangSetHash
hcLangSetSubtract
hcLangSetUnion
hcMatrixCopy
hcMatrixEqual
hcMatrixMultiply
hcMatrixRotate
hcMatrixScale
hcMatrixShear
hcNameConstant
hcNameGetConstant
hcNameGetObjectType
hcNameParse
hcNameRegisterConstants
hcNameRegisterObjectTypes
hcNameUnparse
hcNameUnregisterConstants
hcNameUnregisterObjectTypes
hcObjectSetAdd
hcObjectSetBuild
hcObjectSetCreate
hcObjectSetDestroy
hcObjectSetVaBuild
hcPatternAdd
hcPatternAddBool
hcPatternAddCharSet
hcPatternAddDouble
hcPatternAddFTFace
hcPatternAddInteger
hcPatternAddLangSet
hcPatternAddMatrix
hcPatternAddRange
hcPatternAddString
hcPatternAddWeak
hcPatternBuild
hcPatternCreate
hcPatternDel
hcPatternDestroy
hcPatternDuplicate
hcPatternEqual
hcPatternEqualSubset
hcPatternFilter
hcPatternFindIter
hcPatternFormat
hcPatternGet
hcPatternGetBool
hcPatternGetCharSet
hcPatternGetDouble
hcPatternGetFTFace
hcPatternGetInteger
hcPatternGetLangSet
hcPatternGetMatrix
hcPatternGetRange
hcPatternGetString
hcPatternGetWithBinding
hcPatternHash
hcPatternIterEqual
hcPatternIterGetObject
hcPatternIterGetValue
hcPatternIterIsValid
hcPatternIterNext
hcPatternIterStart
hcPatternIterValueCount
hcPatternObjectCount
hcPatternPrint
hcPatternReference
hcPatternRemove
hcPatternVaBuild
hcRangeCopy
hcRangeCreateDouble
hcRangeCreateInteger
hcRangeDestroy
hcRangeGetDouble
hcStrBasename
hcStrBuildFilename
hcStrCmp
hcStrCmpIgnoreCase
hcStrCopy
hcStrCopyFilename
hcStrDirname
hcStrDowncase
hcStrFree
hcStrListCreate
hcStrListDone
hcStrListFirst
hcStrListNext
hcStrPlus
hcStrSetAdd
hcStrSetAddFilename
hcStrSetCreate
hcStrSetDel
hcStrSetDestroy
hcStrSetEqual
hcStrSetMember
hcStrStr
hcStrStrIgnoreCase
hcUcs4ToUtf8
hcUtf16Len
hcUtf16ToUcs4
hcUtf8Len
hcUtf8ToUcs4
hcValueDestroy
hcValueEqual
hcValuePrint
hcValueSave
hcWeightFromOpenType
hcWeightFromOpenTypeDouble
hcWeightToOpenType
init

Sections

.text
Size: 195KB - Virtual size: 194KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

88acb35eda01b8669f5b68b19160e655

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

Exports

Exports

Sections

.text Size: 195KB - Virtual size: 194KB

.data Size: 512B - Virtual size: 256B

.rdata Size: 75KB - Virtual size: 75KB

.pdata Size: 8KB - Virtual size: 7KB

.xdata Size: 8KB - Virtual size: 8KB

.bss Size: - Virtual size: 5KB

.edata Size: 6KB - Virtual size: 6KB

.idata Size: 5KB - Virtual size: 5KB

.CRT Size: 512B - Virtual size: 88B

.tls Size: 512B - Virtual size: 16B

.reloc Size: 16KB - Virtual size: 12KB

.text
Size: 195KB - Virtual size: 194KB

.data
Size: 512B - Virtual size: 256B

.rdata
Size: 75KB - Virtual size: 75KB

.pdata
Size: 8KB - Virtual size: 7KB

.xdata
Size: 8KB - Virtual size: 8KB

.bss
Size: - Virtual size: 5KB

.edata
Size: 6KB - Virtual size: 6KB

.idata
Size: 5KB - Virtual size: 5KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 16B

.reloc
Size: 16KB - Virtual size: 12KB