afdqZOzeBVchni[.]dat

Sharing

Copy URL Twitter E-mail

General

Target

afdqZOzeBVchni.dat
Size

281KB
MD5

0e3b217afba1365414908b77bbfa58c7
SHA1

47b2f3ce51301616c8927eb8971e5a346bf31313
SHA256

0ee505630697f4565db562d6a642051afee88fc243111ff3a72f3e4edf89aae6
SHA512

6b4247294dd7b605c38599f446bb79ed933ade7f889c57f0bf7a4d6f28c8fe5d53fc50ab38420a56610df3d9370cea25ca59a26d2a9606b35454dab61c2dce2d
SSDEEP

6144:wnCa7uW+h+IJE+edVtbIDBJF0Ecns6y9cjo2iwJtsykZHqxO34aG30VmXSmzlkRc:W77uEs6T39JDVGF4sjWp5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
afdqZOzeBVchni.dat

Files

afdqZOzeBVchni.dat
.dll windows x86

f2e9757e5dc55604f9953968faf6ed8a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetEvent
ResetEvent
WaitForSingleObject
CreateEventA
WaitForMultipleObjects
GetCurrentProcessId
DeleteCriticalSection
GetSystemInfo
GetTickCount
GetModuleHandleA
GetProcAddress
CreateFileA
GetVersionExA
CreateFileW
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
CancelIo
GetOverlappedResult
DeviceIoControl
SetLastError
GetLastError
CloseHandle
WriteFile
ReadFile
QueryDosDeviceW
GetLogicalDriveStringsW
OpenProcess
GetDriveTypeW
DecodePointer
SetFilePointerEx
GetConsoleMode
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RaiseException
RtlUnwind
InterlockedFlushSList
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
HeapFree
HeapAlloc
LCMapStringW
GetACP
GetStdHandle
GetFileType
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStringTypeW
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleCP
WriteConsoleW

Exports

Exports

af_addBindingRule
af_addFlowCtl
af_addRule
af_addRuleEx
af_adjustProcessPriviledges
af_completeTCPConnectRequest
af_completeUDPConnectRequest
af_deleteBindingRules
af_deleteFlowCtl
af_deleteRules
af_free
af_getConnCount
af_getDriverType
af_getFlowCtlStat
af_getProcessNameA
af_getProcessNameFromKernel
af_getProcessNameW
af_getTCPConnInfo
af_getTCPStat
af_getUDPConnInfo
af_getUDPStat
af_init
af_ipPostReceive
af_ipPostSend
af_modifyFlowCtl
af_registerDriver
af_registerDriverEx
af_setIPEventHandler
af_setOptions
af_setRules
af_setRulesEx
af_setTCPFlowCtl
af_setTCPTimeout
af_setUDPFlowCtl
af_tcpClose
af_tcpDisableFiltering
af_tcpIsProxy
af_tcpPostReceive
af_tcpPostSend
af_tcpSetConnectionState
af_tcpSetSockOpt
af_udpDisableFiltering
af_udpPostReceive
af_udpPostSend
af_udpSetConnectionState
bind

Sections

.text
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 112KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f2e9757e5dc55604f9953968faf6ed8a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 108KB - Virtual size: 107KB

.rdata Size: 32KB - Virtual size: 32KB

.data Size: 2KB - Virtual size: 5KB

.rsrc Size: 112KB - Virtual size: 110KB

.reloc Size: 7KB - Virtual size: 6KB

.text
Size: 108KB - Virtual size: 107KB

.rdata
Size: 32KB - Virtual size: 32KB

.data
Size: 2KB - Virtual size: 5KB

.rsrc
Size: 112KB - Virtual size: 110KB

.reloc
Size: 7KB - Virtual size: 6KB