ff97c8efe2bf366aeb1aec498db18d9dcdf64b4d4c0deda957fb829b2c489dec

Sharing

Copy URL Twitter E-mail

General

Target

ff97c8efe2bf366aeb1aec498db18d9dcdf64b4d4c0deda957fb829b2c489dec
Size

127KB
MD5

933f36a31696847a4504592231505ef9
SHA1

7ce4f946543cbcc180f31ceb48715df43a8bebeb
SHA256

ff97c8efe2bf366aeb1aec498db18d9dcdf64b4d4c0deda957fb829b2c489dec
SHA512

037c5095a61ed260dcfae3a0e8d307d6e8fb53b095a9b949c811761102f239ae0e8428febe4c65155f72f24a9ee0eb903722ec494a03818e31d632ca83c8ef7b
SSDEEP

3072:mPTd1qzLBpFjgzTlpeD+yS1dgHq+wJKijWBMFlAof6kKyMUs95ab9ilvMYAKQCEe:mPTd1xZLCEDWhFDOR8X

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ff97c8efe2bf366aeb1aec498db18d9dcdf64b4d4c0deda957fb829b2c489dec

Files

ff97c8efe2bf366aeb1aec498db18d9dcdf64b4d4c0deda957fb829b2c489dec
.dll windows x86

5deaad7fb8def958dbed800ff70bfc28

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

libgnutls-30

gnutls_bye
gnutls_certificate_allocate_credentials
gnutls_certificate_free_credentials
gnutls_certificate_get_peers
gnutls_certificate_set_x509_key_file
gnutls_certificate_set_x509_trust_file
gnutls_certificate_type_get
gnutls_cipher_get
gnutls_cipher_get_key_size
gnutls_cipher_get_name
gnutls_cipher_suite_get_name
gnutls_compression_get
gnutls_credentials_set
gnutls_deinit
gnutls_global_init
gnutls_handshake
gnutls_hash
gnutls_hash_deinit
gnutls_hash_fast
gnutls_hash_init
gnutls_init
gnutls_kx_get
gnutls_kx_get_name
gnutls_mac_get
gnutls_mac_get_name
gnutls_priority_set_direct
gnutls_protocol_get_name
gnutls_protocol_get_version
gnutls_record_check_pending
gnutls_record_recv
gnutls_record_send
gnutls_rnd
gnutls_strerror
gnutls_transport_get_ptr
gnutls_transport_set_ptr
gnutls_transport_set_ptr2
gnutls_x509_crt_deinit
gnutls_x509_crt_get_dn_by_oid
gnutls_x509_crt_get_issuer_dn_by_oid
gnutls_x509_crt_import
gnutls_x509_crt_init

libgcc_s_dw2-1

__udivdi3
__udivmoddi4

kernel32

CloseHandle
CreateEventA
CreateFileA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FindClose
FindFirstFileA
FreeLibrary
GetCurrentProcess
GetCurrentThreadId
GetFileInformationByHandle
GetFileType
GetFinalPathNameByHandleA
GetHandleInformation
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetSystemTimeAsFileTime
InitializeCriticalSection
IsDBCSLeadByteEx
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
MultiByteToWideChar
PeekNamedPipe
SetEvent
Sleep
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte

msvcrt

__mb_cur_max
_amsg_exit
_close
_dup2
_errno
_fdopen
_fileno
_get_osfhandle
_getcwd
_getmaxstdio
_initterm
_iob
_lock
_lseeki64
_open
_open_osfhandle
_setmaxstdio
_setmode
_stricmp
_unlock
_write
abort
atoi
calloc
fclose
ferror
fgetpos
fopen
fputc
fread
free
fwrite
getc
getenv
gmtime
localtime
localeconv
malloc
memchr
memcpy
memmove
memset
memcmp
realloc
setlocale
setvbuf
strchr
strcmp
strcpy
strerror
strlen
strncmp
vfprintf
wcslen

libwinpthread-1

pthread_mutex_init
pthread_mutexattr_destroy
pthread_mutexattr_init
pthread_mutexattr_settype
pthread_once

ws2_32

WSAGetLastError
inet_ntop
inet_pton
setsockopt

Exports

Exports

BIO_get_fd
BIO_new_socket
ERR_error_string
ERR_get_error
MD5
MD5_Final
MD5_Init
MD5_Update
OpenSSL_add_all_algorithms
RAND_bytes
RAND_egd_bytes
RAND_file_name
RAND_load_file
RAND_pseudo_bytes
RAND_seed
RAND_status
RAND_write_file
RIPEMD160
RIPEMD160_Final
RIPEMD160_Init
RIPEMD160_Update
SSL_CIPHER_description
SSL_CIPHER_get_bits
SSL_CIPHER_get_name
SSL_CIPHER_get_version
SSL_CTX_free
SSL_CTX_new
SSL_CTX_sess_accept
SSL_CTX_sess_accept_good
SSL_CTX_sess_accept_renegotiate
SSL_CTX_sess_connect
SSL_CTX_sess_connect_good
SSL_CTX_sess_connect_renegotiate
SSL_CTX_sess_hits
SSL_CTX_sess_misses
SSL_CTX_sess_number
SSL_CTX_sess_timeouts
SSL_CTX_set_cipher_list
SSL_CTX_set_default_verify_paths
SSL_CTX_set_mode
SSL_CTX_set_options
SSL_CTX_set_verify
SSL_CTX_use_PrivateKey_file
SSL_CTX_use_certificate_file
SSL_accept
SSL_connect
SSL_free
SSL_get_current_cipher
SSL_get_error
SSL_get_peer_certificate
SSL_library_init
SSL_load_error_strings
SSL_new
SSL_pending
SSL_read
SSL_set_bio
SSL_set_connect_state
SSL_set_fd
SSL_set_rfd
SSL_set_verify
SSL_set_wfd
SSL_shutdown
SSL_want
SSL_write
SSLv23_client_method
SSLv23_server_method
SSLv3_client_method
SSLv3_server_method
TLSv1_client_method
TLSv1_server_method
X509_NAME_oneline
X509_free
X509_get_issuer_name
X509_get_subject_name

Sections

.text
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5deaad7fb8def958dbed800ff70bfc28

Headers

DLL Characteristics

File Characteristics

Imports

libgnutls-30

libgcc_s_dw2-1

kernel32

msvcrt

libwinpthread-1

ws2_32

Exports

Exports

Sections

.text Size: 78KB - Virtual size: 78KB

.data Size: 512B - Virtual size: 152B

.rdata Size: 9KB - Virtual size: 8KB

/4 Size: 20KB - Virtual size: 20KB

.bss Size: - Virtual size: 2KB

.edata Size: 2KB - Virtual size: 2KB

.idata Size: 5KB - Virtual size: 4KB

.CRT Size: 512B - Virtual size: 44B

.tls Size: 512B - Virtual size: 8B

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 78KB - Virtual size: 78KB

.data
Size: 512B - Virtual size: 152B

.rdata
Size: 9KB - Virtual size: 8KB

/4
Size: 20KB - Virtual size: 20KB

.bss
Size: - Virtual size: 2KB

.edata
Size: 2KB - Virtual size: 2KB

.idata
Size: 5KB - Virtual size: 4KB

.CRT
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 8B

.reloc
Size: 3KB - Virtual size: 2KB