raccoon | d0532563185e7e5b893cefd080e092fb330c9ee5dc62f2a275e46e318c47c283

Sharing

Copy URL

Twitter E-mail

General

Target

d0532563185e7e5b893cefd080e092fb330c9ee5dc62f2a275e46e318c47c283
Size

3.8MB
MD5

43532202c3b212d2319ce4ffae3b45ba
SHA1

d664cca3b3d36c717269541211b58c66798abdcb
SHA256

d0532563185e7e5b893cefd080e092fb330c9ee5dc62f2a275e46e318c47c283
SHA512

b5349d462dac6610468f44eda8605fcd0e48fa0381f1a40af863c5182cdb96205452e3e710b6896c71b9b7de0a0429a1704cd2b102f8842479eebb882512c3f5
SSDEEP

49152:jnXEmbEwjgpvW8kBF7BRpw8vl5an9ZP5bnUFSwtaEFoJgTdh1wIdVXU8ivtEGOF3:jnX/Ewjgp5eF71wolebnUFSqaKoIYvt4

Score

10^/10

raccoon

Malware Config

Extracted

Family

raccoon

rc4.plain

Signatures

Raccoon family
raccoon

Files

d0532563185e7e5b893cefd080e092fb330c9ee5dc62f2a275e46e318c47c283
.exe windows x86

572ae4049e9cabcfc4ae43dcb556c61c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

QueryPerformanceCounter
InitializeSListHead
OutputDebugStringW
SizeofResource
InterlockedDecrement
LoadResource
FindResourceW
InterlockedIncrement
lstrcmpiW
GetSystemDefaultLangID
InterlockedExchange
GetPrivateProfileStructW
WritePrivateProfileStringW
GetPrivateProfileStringW
WritePrivateProfileStructW
lstrcpyW
ExitProcess
GetFileAttributesW
CreateToolhelp32Snapshot
GetExitCodeThread
Process32NextW
TerminateThread
Process32FirstW
CreateDirectoryW
lstrcmpW
RtlUnwind
InterlockedPushEntrySList
GetConsoleCP
GetConsoleMode
GetModuleHandleExW
HeapAlloc
HeapReAlloc
HeapFree
GetStdHandle
GetACP
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
GetTimeZoneInformation
FlushFileBuffers
SetStdHandle
SetFilePointerEx
WriteConsoleW
GetProcessHeap
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
HeapSize
ReadFile
SetPriorityClass
ResetEvent
ResumeThread
OpenProcess
GetSystemInfo
HeapSetInformation
FileTimeToSystemTime
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
QueryDosDeviceW
FindFirstFileW
GetStartupInfoW
RemoveDirectoryW
GetTempPathW
UnmapViewOfFile
GetLogicalDriveStringsW
GetFileAttributesExW
GetCurrentDirectoryW
ReplaceFileW
GetFileSize
GetTempFileNameW
CreateFileMappingW
MapViewOfFile
GetSystemDirectoryW
GetWindowsDirectoryW
RtlCaptureStackBackTrace
SetEndOfFile
WaitForMultipleObjects
MulDiv
GetThreadLocale
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
CancelIo
GetFileSizeEx
InitializeCriticalSection
LockResource
GlobalSize
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
GetPrivateProfileIntW
GetLocalTime
VirtualProtect
GetVolumeInformationW
DeviceIoControl
MoveFileW
AreFileApisANSI
HeapCreate
GetFullPathNameW
GetDiskFreeSpaceW
LockFile
GetFullPathNameA
UnlockFileEx
HeapValidate
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
FlushViewOfFile
CreateFileA
LoadLibraryA
GetVersionExA
DeleteFileA
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LockFileEx
GetSystemTime
VirtualFree
VirtualAlloc
IsBadReadPtr
FreeLibraryAndExitThread
GetDriveTypeW
ReadConsoleW
GetSystemPowerStatus
SleepEx
PeekNamedPipe
SetEvent
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
GetSystemTimeAsFileTime
MultiByteToWideChar
EncodePointer
WideCharToMultiByte
FormatMessageW
ExitThread
LoadLibraryExA
FlushInstructionCache
InterlockedPopEntrySList
TerminateProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLongPathNameW
WaitForSingleObjectEx
TlsFree
TlsGetValue
TlsAlloc
TlsSetValue
FreeLibrary
GetNativeSystemInfo
GetVersionExW
InterlockedExchangeAdd
CreateThread
Sleep
IsDebuggerPresent
LeaveCriticalSection
EnterCriticalSection
TryEnterCriticalSection
GetModuleHandleW
LoadLibraryW
lstrlenW
GetCurrentProcess
InterlockedCompareExchange
LocalFree
GetCommandLineW
CreateEventW
ExpandEnvironmentStringsW
GetTickCount
FormatMessageA
CreateProcessW
GetCurrentProcessId
CloseHandle
DeleteFileW
GetModuleHandleA
ReleaseMutex
GetCurrentThreadId
CreateFileW
WaitForSingleObject
CreateMutexW
SetFilePointer
GetModuleFileNameW
OutputDebugStringA
WriteFile
SetLastError
DeleteCriticalSection
DecodePointer
RaiseException
GetLastError
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
GetProcAddress
SetCurrentDirectoryW
AssignProcessToJobObject

user32

DrawTextExW
DestroyMenu
UnhookWindowsHookEx
SetMenuInfo
SetMenuItemInfoW
GetSubMenu
CreatePopupMenu
CallNextHookEx
GetMenuItemCount
InsertMenuItemW
GetMenuState
GetMenuItemInfoW
SetRectEmpty
CallWindowProcW
GetSysColorBrush
GetClassInfoExW
UpdateWindow
ActivateKeyboardLayout
GetKeyboardLayout
GetCaretPos
GetWindowTextLengthW
GetComboBoxInfo
FindWindowW
DrawIconEx
GetGuiResources
WaitMessage
RegisterClassExW
SetTimer
PeekMessageW
MsgWaitForMultipleObjectsEx
CallMsgFilterW
GetQueueStatus
KillTimer
PostQuitMessage
CharLowerW
EnumDisplayMonitors
RedrawWindow
SetLayeredWindowAttributes
MoveWindow
GetMessagePos
MonitorFromPoint
GetWindowInfo
ScreenToClient
AdjustWindowRectEx
RegisterShellHookWindow
MapVirtualKeyW
DeregisterShellHookWindow
keybd_event
GetActiveWindow
MapWindowPoints
SetWinEventHook
RegisterWindowMessageW
UnhookWinEvent
CreateWindowExW
SetFocus
GetWindowDC
GetDC
ReleaseDC
DispatchMessageW
TranslateMessage
GetCursorPos
SetScrollInfo
SetWindowTextW
GetAsyncKeyState
ClientToScreen
GetSysColor
EnableWindow
EndMenu
LoadIconW
InvalidateRect
LoadAcceleratorsW
CopyAcceleratorTableW
FlashWindowEx
GetClientRect
PostMessageW
GetWindow
DestroyWindow
GetIconInfo
GetSystemMetrics
IsWindow
DestroyIcon
SetParent
GetClassLongW
GetParent
SetForegroundWindow
IsIconic
GetWindowTextW
FindWindowExW
SendMessageW
SetWindowLongW
GetDesktopWindow
GetAncestor
GetWindowLongW
GetWindowRect
IsWindowVisible
SetWindowPos
ShowWindow
EnumWindows
EnumThreadWindows
IsZoomed
PtInRect
GetUpdateRect
SetCapture
SetCursor
GetDlgItem
UpdateLayeredWindow
SetRect
EnableMenuItem
ReleaseCapture
GetSystemMenu
TrackPopupMenu
MonitorFromRect
MonitorFromWindow
WindowFromPoint
GetMonitorInfoW
DrawFocusRect
DrawFrameControl
GetWindowRgn
GetWindowThreadProcessId
AttachThreadInput
GetForegroundWindow
DefWindowProcW
CharNextW
FrameRect
InvertRect
InflateRect
SetWindowsHookExW
GetMenuInfo
RegisterClipboardFormatW
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
DrawEdge
IsChild
GetFocus
SetWindowRgn
UnionRect
NotifyWinEvent
GetWindowPlacement
OffsetRect
GetCapture
SetWindowPlacement
ValidateRect
TrackMouseEvent
IsWindowEnabled
IsClipboardFormatAvailable
LoadCursorW
FillRect
DrawTextW
BeginPaint
IsRectEmpty
EnumChildWindows
IntersectRect
EndPaint
GetDoubleClickTime
CreateIconIndirect
wsprintfW
GetKeyState
SystemParametersInfoW
CharUpperW
MessageBoxW
UnregisterClassW
GetClassNameW

advapi32

RegEnumKeyW
RegOpenKeyW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CreateProcessAsUserW
RegDeleteKeyW
OpenProcessToken
RegCloseKey
RegQueryInfoKeyW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegQueryValueExW

shell32

CommandLineToArgvW
SHGetSpecialFolderPathW
SHAppBarMessage
DragFinish
ShellExecuteExW
DragQueryFileW
SHFileOperationW
SHBrowseForFolderW
SHGetFileInfoW
SHGetDesktopFolder
SHGetPathFromIDListW
ord155
ord18
SHCreateShellItem
ShellExecuteW
SHGetFolderPathW

ole32

OleDuplicateData
ReleaseStgMedium
RevokeDragDrop
CreateBindCtx
CoInitialize
CoTaskMemRealloc
OleInitialize
CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc
OleUninitialize
PropVariantClear
CoUninitialize
DoDragDrop
RegisterDragDrop

shlwapi

PathFileExistsW
PathRemoveFileSpecW
UrlCreateFromPathA
PathFindExtensionW
PathIsUNCW
PathFileExistsA
PathRemoveExtensionW
PathFindFileNameW
PathIsUNCA
UrlCreateFromPathW
PathCreateFromUrlW
StrCpyW
PathIsDirectoryW
ord9
ord8
SHStrDupW

dwmapi

DwmGetWindowAttribute
DwmSetWindowAttribute
DwmIsCompositionEnabled
DwmDefWindowProc
DwmExtendFrameIntoClientArea

gdi32

CreateBitmap
IntersectClipRect
RestoreDC
GetStockObject
SaveDC
SetMapMode
GetTextExtentPoint32W
GetTextMetricsW
CreateCompatibleBitmap
GetRgnBox
SetPolyFillMode
EqualRgn
CreateSolidBrush
PtInRegion
CreateRectRgn
DeleteDC
GdiAlphaBlend
SetViewportOrgEx
SetLayout
GetObjectW
EndPath
SelectClipRgn
SetArcDirection
SetDCBrushColor
SetBkColor
SetStretchBltMode
SetROP2
SetDCPenColor
SelectObject
SetGraphicsMode
GdiFlush
SetTextColor
SetBrushOrgEx
AbortPath
BeginPath
StretchBlt
CreatePolygonRgn
CreateRectRgnIndirect
PolyBezier
CreateCompatibleDC
CreateDIBSection
GetBkColor
PathToRegion
BitBlt
GetFontData
SetBkMode
GetGlyphIndicesW
GetGlyphOutlineW
CreateFontIndirectW
GetOutlineTextMetricsW
SetTextAlign
ExtTextOutW
SetWorldTransform
ExcludeClipRect
DeleteObject
GetDeviceCaps

comdlg32

GetSaveFileNameW
CommDlgExtendedError
GetOpenFileNameW

oleaut32

SysFreeString
SysStringLen
SysAllocString
LoadTypeLi
LoadRegTypeLi
VarUI4FromStr

psapi

GetModuleFileNameExW
EnumProcesses
GetProcessMemoryInfo

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

winmm

timeGetTime
timeBeginPeriod
timeEndPeriod

dbghelp

SymGetLineFromAddr64
SymInitialize
SymFromAddr
SymSetOptions

usp10

ScriptFreeCache
ScriptShape
ScriptItemize

oleacc

ObjectFromLresult
AccessibleObjectFromWindow
LresultFromObject

imm32

ImmGetCompositionStringW
ImmGetContext
ImmReleaseContext

urlmon

URLDownloadToFileW

iphlpapi

GetAdaptersInfo

comctl32

ImageList_Destroy
ImageList_Create
ImageList_ReplaceIcon

msimg32

AlphaBlend

wldap32

ord142
ord79
ord133
ord27
ord26
ord147
ord127
ord301
ord167
ord118
ord41
ord208
ord216
ord145
ord46
ord14

ws2_32

listen
recvfrom
sendto
WSACleanup
gethostname
ntohs
setsockopt
WSASetLastError
getaddrinfo
freeaddrinfo
__WSAFDIsSet
select
ioctlsocket
WSAStartup
htons
closesocket
socket
WSAGetLastError
recv
send
bind
connect
getpeername
getsockname
getsockopt
accept

Exports

Exports

curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_maprintf
curl_mfprintf
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape

Sections

.text
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 672KB - Virtual size: 671KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 39KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 892B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 155KB - Virtual size: 155KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

572ae4049e9cabcfc4ae43dcb556c61c

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

shlwapi

dwmapi

gdi32

comdlg32

oleaut32

psapi

userenv

winmm

dbghelp

usp10

oleacc

imm32

urlmon

iphlpapi

comctl32

msimg32

wldap32

ws2_32

Exports

Exports

Sections

.text Size: 2.9MB - Virtual size: 2.9MB

.rdata Size: 672KB - Virtual size: 671KB

.data Size: 39KB - Virtual size: 85KB

.gfids Size: 1024B - Virtual size: 892B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 54KB - Virtual size: 54KB

.reloc Size: 155KB - Virtual size: 155KB

.text
Size: 2.9MB - Virtual size: 2.9MB

.rdata
Size: 672KB - Virtual size: 671KB

.data
Size: 39KB - Virtual size: 85KB

.gfids
Size: 1024B - Virtual size: 892B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 54KB - Virtual size: 54KB

.reloc
Size: 155KB - Virtual size: 155KB