akH2GtJyY9[.]dat

Sharing

Copy URL

Twitter E-mail

General

Target

akH2GtJyY9.dat
Size

281KB
MD5

7d0938cd164c686eb9ca0da3908d2123
SHA1

2f968150fe61addeae65e1c42237f2c273f2573c
SHA256

3d3b8404eee9ed50e57e4c8cd659e497afcdd8a66d368585ed8c19bac5670c7c
SHA512

628661bae4a4edf63de5b27cb09e435ddabac930c1a73b8e62ec5f4b6c082ebc885750ba97ce0dc468eccc46599571f95c36de6424e60ceff64caa38f75db0d0
SSDEEP

6144:wnCa7uW+h+IJE+edVtbIDBJF0Ecns6y9cjo2iwJtsykZHqxO34aG30VmXSmzlkR1:W77uEs6T39JDVGF4sjWpk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
akH2GtJyY9.dat

Files

akH2GtJyY9.dat
.dll windows x86

f2e9757e5dc55604f9953968faf6ed8a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetEvent
ResetEvent
WaitForSingleObject
CreateEventA
WaitForMultipleObjects
GetCurrentProcessId
DeleteCriticalSection
GetSystemInfo
GetTickCount
GetModuleHandleA
GetProcAddress
CreateFileA
GetVersionExA
CreateFileW
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
CancelIo
GetOverlappedResult
DeviceIoControl
SetLastError
GetLastError
CloseHandle
WriteFile
ReadFile
QueryDosDeviceW
GetLogicalDriveStringsW
OpenProcess
GetDriveTypeW
DecodePointer
SetFilePointerEx
GetConsoleMode
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RaiseException
RtlUnwind
InterlockedFlushSList
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
HeapFree
HeapAlloc
LCMapStringW
GetACP
GetStdHandle
GetFileType
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStringTypeW
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleCP
WriteConsoleW

Exports

Exports

af_addBindingRule
af_addFlowCtl
af_addRule
af_addRuleEx
af_adjustProcessPriviledges
af_completeTCPConnectRequest
af_completeUDPConnectRequest
af_deleteBindingRules
af_deleteFlowCtl
af_deleteRules
af_free
af_getConnCount
af_getDriverType
af_getFlowCtlStat
af_getProcessNameA
af_getProcessNameFromKernel
af_getProcessNameW
af_getTCPConnInfo
af_getTCPStat
af_getUDPConnInfo
af_getUDPStat
af_init
af_ipPostReceive
af_ipPostSend
af_modifyFlowCtl
af_registerDriver
af_registerDriverEx
af_setIPEventHandler
af_setOptions
af_setRules
af_setRulesEx
af_setTCPFlowCtl
af_setTCPTimeout
af_setUDPFlowCtl
af_tcpClose
af_tcpDisableFiltering
af_tcpIsProxy
af_tcpPostReceive
af_tcpPostSend
af_tcpSetConnectionState
af_tcpSetSockOpt
af_udpDisableFiltering
af_udpPostReceive
af_udpPostSend
af_udpSetConnectionState
bind

Sections

.text
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 112KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f2e9757e5dc55604f9953968faf6ed8a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 108KB - Virtual size: 107KB

.rdata Size: 32KB - Virtual size: 32KB

.data Size: 2KB - Virtual size: 5KB

.rsrc Size: 112KB - Virtual size: 110KB

.reloc Size: 7KB - Virtual size: 6KB

.text
Size: 108KB - Virtual size: 107KB

.rdata
Size: 32KB - Virtual size: 32KB

.data
Size: 2KB - Virtual size: 5KB

.rsrc
Size: 112KB - Virtual size: 110KB

.reloc
Size: 7KB - Virtual size: 6KB