15199e964159a67ff6bab2bbe4b3d760c4d52c69a789c1d59dda01a40c0b7773

Sharing

Copy URL Twitter E-mail

General

Target

15199e964159a67ff6bab2bbe4b3d760c4d52c69a789c1d59dda01a40c0b7773
Size

398KB
MD5

3e2742b522c4a50a5f65e38130590526
SHA1

cbc7db8f94af67a0469e058314f166d5a61683c1
SHA256

15199e964159a67ff6bab2bbe4b3d760c4d52c69a789c1d59dda01a40c0b7773
SHA512

1b9141bcc3a48ad5c052401596ac174624cdcbbc31988984dce24784444226e406bc6d56459276ac7a980cfb27dd79cbaf3c38f6f02eca9582f993f1390b33ba
SSDEEP

6144:rNAXEsmBfpKVeFrUzriHxbDE5uxzb6HU6exswHo3TvX4lYgUVfRm:riXEhx08p6HU6exGhgUV

Score

1^/10

Malware Config

Signatures

Files

15199e964159a67ff6bab2bbe4b3d760c4d52c69a789c1d59dda01a40c0b7773
.dll windows x64

cb09faa6adad0d8581e35ab38e11dbb1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ws2_32

WSAStartup
listen
bind
closesocket
getsockname
setsockopt
socket
getaddrinfo
freeaddrinfo
accept
connect
ioctlsocket
htonl
WSACleanup
recv
send
WSAIoctl
getsockopt
shutdown
WSAGetLastError
WSARecv
WSASend

csky

?OnSkyMessage@CBridge@@UEAAXPEAVCSkyMessage@@@Z
?Initialize@CBridge@@UEAAHXZ
?UnInitialize@CBridge@@UEAAXXZ
?PostExpoMessage@CBridge@@UEAAHPEBE@Z
?PostExpoMessage@CBridge@@UEAAHPEBEAEAI@Z
?SendExpoMessage@CBridge@@UEAAHPEBEAEAPEAEI@Z
?SerializePackageHeader@CMessage@@QEAAXXZ
?CopySerializedData@CMessage@@QEAAXPEBE_K@Z
??1CBridge@@UEAA@XZ
?GetBodySize@CSkyMessage@@UEAAIXZ
?UnSerializeBody@CSkyMessage@@UEAAHPEAE_K@Z
?UnSerializeHeader@CSkyMessage@@UEAAHXZ
?UnSerialize@CSkyMessage@@UEAAHPEAE_K@Z
?UnSerialize@CSkyMessage@@UEAAHXZ
?Serialize@CSkyMessage@@UEAAXXZ
?CopyTo@CSkyMessage@@UEAAXPEAVCMessage@@@Z
?Clone@CSkyMessage@@UEAAPEAVCMessage@@XZ
?GetLength@CMessage@@UEBAIXZ
?GetSerializedData@CMessage@@QEAAPEAEXZ
??1CSkyMessage@@UEAA@XZ
?SerializeBody@CSkyMessage@@UEAAHPEAE_K@Z
?GetHeader@CMessage@@QEAAAEAUMessageHeader@@XZ
??0CBridge@@QEAA@GGGPEAVISkyProxy@@PEAVCExpoConnection@MessageBus@@@Z
??0CSkyMessage@@QEAA@XZ

logtool

Log4cxx

mfc140u

ord1491
ord1489
ord6121
ord14288
ord7719
ord12212
ord14088
ord11665
ord11664
ord2011
ord7668
ord3949
ord4011
ord9089
ord14216
ord7650
ord14210
ord12223
ord12222
ord2439
ord5183
ord8023
ord12544
ord8084
ord1033
ord286
ord2921
ord5709
ord285
ord290
ord2903
ord1034
ord1667
ord1670
ord265
ord310
ord1503
ord1501
ord7393
ord983
ord1450
ord7716
ord6614
ord8900
ord9941
ord7922
ord5227
ord7450
ord7461
ord7460
ord5062
ord5229
ord5083
ord5555
ord5339
ord9041
ord5552
ord5363
ord5080
ord12606
ord11901
ord11933
ord10124
ord7920
ord4445
ord11929
ord11921
ord5706
ord3731
ord6122
ord14289
ord6123
ord12625
ord14290
ord3728
ord1492
ord324
ord1040
ord2327
ord2212
ord323
ord1039
ord2369
ord2372
ord2338
ord2371
ord473
ord2234
ord2336
ord2161
ord2266
ord2360
ord8167

kernel32

CloseHandle
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
WaitForSingleObject
GetCurrentThread
GetCurrentThreadId
GetSystemInfo
LoadLibraryA
MultiByteToWideChar
CreateIoCompletionPort
GetQueuedCompletionStatus
CreateEventA
CreateFileA
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcAddress
FreeLibrary
GetLastError
LoadLibraryW
SetDllDirectoryW
GetFullPathNameW
GetModuleHandleA
GetModuleFileNameW
WideCharToMultiByte
GetPrivateProfileStringW
GetModuleHandleW
GetTickCount64
SetHandleInformation
CancelIoEx
WriteFile
GetNamedPipeClientProcessId
GetNamedPipeServerProcessId
ConnectNamedPipe
CreateNamedPipeA
OutputDebugStringW
ReadFile
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
LeaveCriticalSection
EnterCriticalSection
LocalFree
LocalAlloc
InitializeCriticalSectionAndSpinCount
DisconnectNamedPipe

user32

CopyRect
GetClientRect

advapi32

IsValidSecurityDescriptor

msvcp140

_Mtx_destroy
_Cnd_destroy
_Cnd_do_broadcast_at_thread_exit
_Mtx_init
_Thrd_join
_Thrd_start
_Cnd_init
_Thrd_id
?_Throw_C_error@std@@YAXH@Z
_Mtx_lock
_Mtx_unlock
_Cnd_signal
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Cnd_init_in_situ
_Cnd_destroy_in_situ
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
_Cnd_wait

vcruntime140

__CxxFrameHandler3
_CxxThrowException
__std_exception_destroy
__std_exception_copy
_purecall
wcsrchr
memcpy
memcmp
memset
memmove
strchr
strstr
__C_specific_handler
__std_type_info_destroy_list
__std_terminate

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function
_seh_filter_dll
_errno
_initialize_narrow_environment
_initialize_onexit_table
_execute_onexit_table
_crt_atexit
_configure_narrow_argv
terminate
_cexit
_initterm
_invalid_parameter_noinfo_noreturn
_initterm_e
strerror
abort
_beginthreadex

api-ms-win-crt-string-l1-1-0

isxdigit
toupper
strnlen
_stricmp
strncpy
strncpy_s
isdigit
isalnum
strcmp
isprint
tolower
_strnicmp
strcpy_s
strncmp

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vsprintf

api-ms-win-crt-convert-l1-1-0

strtoull
strtol
strtoll
strtod
atoi

api-ms-win-crt-math-l1-1-0

_dtest
_dsign

api-ms-win-crt-heap-l1-1-0

malloc
free
calloc

api-ms-win-crt-utility-l1-1-0

rand_s

Exports

Exports

CreateBridge
CreateSubProcessor
ReleaseBridge
ReleaseSubProcessor
StartClient
StartServer
StopClient
StopServer
wkCreateWebWindowAndNavigate
wkExcuseJs
wkRegistOnBeforeNavigateFunc
wkRegistOnClientFunc
wkRegistOnDocCompleted
wkSetSize

Sections

.text
Size: 286KB - Virtual size: 285KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cb09faa6adad0d8581e35ab38e11dbb1

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

csky

logtool

mfc140u

kernel32

user32

advapi32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

Exports

Exports

Sections

.text Size: 286KB - Virtual size: 285KB

.rdata Size: 80KB - Virtual size: 79KB

.data Size: 8KB - Virtual size: 12KB

.pdata Size: 19KB - Virtual size: 18KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 286KB - Virtual size: 285KB

.rdata
Size: 80KB - Virtual size: 79KB

.data
Size: 8KB - Virtual size: 12KB

.pdata
Size: 19KB - Virtual size: 18KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 2KB