aHbmLMlIO418[.]dat

Resubmissions

24-05-2023 19:12

230524-xwtblseg5w 10

24-05-2023 19:09

230524-xt8zaaeg3s 3

Sharing

Copy URL

Twitter E-mail

General

Target

aHbmLMlIO418.dat
Size

281KB
MD5

943766ef427b03053fcffb3a4c50e301
SHA1

84e1d5b37d874e39788ff7fdadf2eb276bcefb13
SHA256

adcc94488fdf45534af8c4bc7e1621fdd854f953c37045b29d36b2e1f7a978cf
SHA512

c315bc035972885cc48a2b44fd4083c55559c31361ecca388a7cc023e84c96d2143e4a1204127f5cee6b452854894c24dea34a5810c54fd2a67e79a2b255dece
SSDEEP

6144:wnCa7uW+h+IJE+edVtbIDBJF0Ecns6y9cjo2iwJtsykZHqxO34aG30VmXSmzlkRO:W77uEs6T39JDVGF4sjWp/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aHbmLMlIO418.dat

Files

aHbmLMlIO418.dat
.dll windows x86

f2e9757e5dc55604f9953968faf6ed8a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetEvent
ResetEvent
WaitForSingleObject
CreateEventA
WaitForMultipleObjects
GetCurrentProcessId
DeleteCriticalSection
GetSystemInfo
GetTickCount
GetModuleHandleA
GetProcAddress
CreateFileA
GetVersionExA
CreateFileW
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
CancelIo
GetOverlappedResult
DeviceIoControl
SetLastError
GetLastError
CloseHandle
WriteFile
ReadFile
QueryDosDeviceW
GetLogicalDriveStringsW
OpenProcess
GetDriveTypeW
DecodePointer
SetFilePointerEx
GetConsoleMode
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RaiseException
RtlUnwind
InterlockedFlushSList
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
HeapFree
HeapAlloc
LCMapStringW
GetACP
GetStdHandle
GetFileType
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStringTypeW
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleCP
WriteConsoleW

Exports

Exports

af_addBindingRule
af_addFlowCtl
af_addRule
af_addRuleEx
af_adjustProcessPriviledges
af_completeTCPConnectRequest
af_completeUDPConnectRequest
af_deleteBindingRules
af_deleteFlowCtl
af_deleteRules
af_free
af_getConnCount
af_getDriverType
af_getFlowCtlStat
af_getProcessNameA
af_getProcessNameFromKernel
af_getProcessNameW
af_getTCPConnInfo
af_getTCPStat
af_getUDPConnInfo
af_getUDPStat
af_init
af_ipPostReceive
af_ipPostSend
af_modifyFlowCtl
af_registerDriver
af_registerDriverEx
af_setIPEventHandler
af_setOptions
af_setRules
af_setRulesEx
af_setTCPFlowCtl
af_setTCPTimeout
af_setUDPFlowCtl
af_tcpClose
af_tcpDisableFiltering
af_tcpIsProxy
af_tcpPostReceive
af_tcpPostSend
af_tcpSetConnectionState
af_tcpSetSockOpt
af_udpDisableFiltering
af_udpPostReceive
af_udpPostSend
af_udpSetConnectionState
bind

Sections

.text
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 112KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

f2e9757e5dc55604f9953968faf6ed8a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 108KB - Virtual size: 107KB

.rdata Size: 32KB - Virtual size: 32KB

.data Size: 2KB - Virtual size: 5KB

.rsrc Size: 112KB - Virtual size: 110KB

.reloc Size: 7KB - Virtual size: 6KB

.text
Size: 108KB - Virtual size: 107KB

.rdata
Size: 32KB - Virtual size: 32KB

.data
Size: 2KB - Virtual size: 5KB

.rsrc
Size: 112KB - Virtual size: 110KB

.reloc
Size: 7KB - Virtual size: 6KB