85e06ee1c85525fc4ce0beb012e439a0c02843ffbeb6b7b071dd602fa4bb1882

Sharing

Copy URL

Twitter E-mail

General

Target

85e06ee1c85525fc4ce0beb012e439a0c02843ffbeb6b7b071dd602fa4bb1882
Size

855KB
MD5

2ae130b6d702ba356c7eb5e3511db935
SHA1

67e9fc9e13ffea267b8865543bb08565f099db91
SHA256

85e06ee1c85525fc4ce0beb012e439a0c02843ffbeb6b7b071dd602fa4bb1882
SHA512

2c0b6b97aa7271d1c3924b554a901858032e0ac92809a2ed983aad7392b32fa6bf56aa1c1a0aa5453babbf2956715cd24483ee3d915a060f9d9a4bbc9d7629e7
SSDEEP

24576:mXkI5oLt0IqqfD40a1dYfEWKHNFVOPDo5b9wa:q5qfD40odmEWKNOIaa

Score

9^/10

oss_ak

Malware Config

Signatures

detect oss ak 1 IoCs

oss ak information detected.

oss_ak

resource	yara_rule
sample	detect_ak_stuff

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
85e06ee1c85525fc4ce0beb012e439a0c02843ffbeb6b7b071dd602fa4bb1882

Files

85e06ee1c85525fc4ce0beb012e439a0c02843ffbeb6b7b071dd602fa4bb1882
.dll windows x86

4311aa0987f1fe17f4ad55ab18537605

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetLastError
MultiByteToWideChar
GetTempPathW
DecodePointer
RaiseException
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionEx
DeleteCriticalSection
CreateMutexA
WideCharToMultiByte
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
ProcessIdToSessionId
OpenProcess
WTSGetActiveConsoleSessionId
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
VerSetConditionMask
GetCurrentProcess
GlobalMemoryStatusEx
GetLocalTime
VerifyVersionInfoW
ReadFile
GetModuleHandleW
GetProcAddress
LoadLibraryW
RtlUnwind
GetFileSizeEx
CreateFileW
InterlockedPushEntrySList
InterlockedFlushSList
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetFileType
CloseHandle
OutputDebugStringW
GetCPInfo
GetStringTypeW
OpenEventA
CreateEventA
GetLocaleInfoW
CompareStringW
QueryPerformanceFrequency
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
SetLastError
EncodePointer
TryEnterCriticalSection
InitializeSListHead
GetSystemTimeAsFileTime
GetStartupInfoW
IsDebuggerPresent
WaitForSingleObjectEx
ResetEvent
FreeLibrary
CreateTimerQueue
UnregisterWaitEx
QueryDepthSList
InterlockedPopEntrySList
ReleaseSemaphore
DuplicateHandle
VirtualFree
VirtualProtect
VirtualAlloc
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SignalObjectAndWait
WriteConsoleW
SetEnvironmentVariableW
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
IsProcessorFeaturePresent
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
SetStdHandle
GetTimeZoneInformation
ReadConsoleW
FlushFileBuffers
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateThread
Sleep
GetConsoleMode
GetConsoleCP
EnumSystemLocalesW
GetUserDefaultLCID
CreateEventW
WaitForSingleObject
SetEvent
GetTickCount
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetStdHandle
GetCurrentThread
GlobalFree
lstrcpyW
lstrcpynW
GlobalAlloc
DeleteFileW
FindClose
FindNextFileW
GetFileAttributesW
RemoveDirectoryW
SetEndOfFile
SetFilePointerEx
DeviceIoControl
MoveFileExW
LCMapStringW
AreFileApisANSI
FormatMessageA
LocalFree
WriteFile
GetSystemDirectoryW
GetVersionExW
GetModuleFileNameW

advapi32

RegOpenKeyExA
RegCloseKey
GetUserNameW
RevertToSelf
ImpersonateLoggedOnUser
OpenProcessToken
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
RegQueryValueExA

shell32

SHGetFolderPathW
SHGetSpecialFolderPathW

ole32

CoCreateGuid

libapr-1

_apr_array_make@12
_apr_array_push@4
_apr_array_pop@4
_apr_strnatcmp@8
_apr_pstrndup@12
_apr_pool_destroy@4
_apr_time_now@0
_apr_table_make@8
_apr_table_set@12
_apr_palloc@8
_apr_pstrdup@8
_apr_time_exp_gmt@12
_apr_pool_create_ex@16
_apr_strnatcasecmp@8
_apr_file_close@4
_apr_strerror@12
_apr_table_elts@4
_apr_thread_mutex_destroy@4
_apr_is_empty_table@4
_apr_file_open@20
_apr_file_info_get@12
_apr_os_thread_current@0
_apr_time_exp_lt@12
_apr_table_addn@12
_apr_table_add@12
_apr_table_get@8
_apr_thread_mutex_create@12
_apr_thread_mutex_lock@4
apr_terminate
_apr_file_write@12
apr_snprintf
_apr_initialize@0
_apr_file_read@12
_apr_thread_mutex_unlock@4
apr_psprintf

mxml1

mxmlDelete
mxmlFindElement
mxml_opaque_cb
mxmlLoadString

libcurl

curl_easy_reset
curl_easy_cleanup
curl_easy_strerror
curl_easy_perform
curl_easy_getinfo
curl_slist_append
curl_slist_free_all
curl_easy_setopt
curl_global_init
curl_global_cleanup
curl_easy_init

libaprutil-1

_apr_sha1_update@12
_apr_sha1_init@4
_apr_sha1_final@8

winhttp

WinHttpReceiveResponse
WinHttpOpenRequest
WinHttpCrackUrl
WinHttpReadData
WinHttpConnect
WinHttpCloseHandle
WinHttpAddRequestHeaders
WinHttpOpen
WinHttpSendRequest

wtsapi32

WTSQuerySessionInformationW
WTSQueryUserToken
WTSFreeMemory

ws2_32

inet_addr

netapi32

Netbios

Exports

Exports

Log
create_log_producer
create_log_producer_config
destroy_log_producer
destroy_log_producer_config
doUpload
fileWrite
getFolderPath
get_log_producer_client
init
is_log_producer_result_ok
log_producer_client_add_log
log_producer_client_add_log_with_len
log_producer_client_add_log_with_len_time
log_producer_client_add_raw_log_buffer
log_producer_client_network_recover
log_producer_config_add_tag
log_producer_config_get_security
log_producer_config_is_valid
log_producer_config_reset_security_token
log_producer_config_set_access_id
log_producer_config_set_access_key
log_producer_config_set_compress_type
log_producer_config_set_connect_timeout_sec
log_producer_config_set_destroy_flusher_wait_sec
log_producer_config_set_destroy_sender_wait_sec
log_producer_config_set_endpoint
log_producer_config_set_log_queue_size
log_producer_config_set_logstore
log_producer_config_set_max_buffer_limit
log_producer_config_set_net_interface
log_producer_config_set_ntp_time_offset
log_producer_config_set_packet_log_bytes
log_producer_config_set_packet_log_count
log_producer_config_set_packet_timeout
log_producer_config_set_project
log_producer_config_set_send_thread_count
log_producer_config_set_send_timeout_sec
log_producer_config_set_source
log_producer_config_set_topic
log_producer_env_destroy
log_producer_env_init
log_set_get_time_function
pingback
test
uploadlog

Sections

.text
Size: 657KB - Virtual size: 656KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 148KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4311aa0987f1fe17f4ad55ab18537605

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

shell32

ole32

libapr-1

mxml1

libcurl

libaprutil-1

winhttp

wtsapi32

ws2_32

netapi32

Exports

Exports

Sections

.text Size: 657KB - Virtual size: 656KB

.rdata Size: 148KB - Virtual size: 148KB

.data Size: 15KB - Virtual size: 57KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 32KB - Virtual size: 32KB

.text
Size: 657KB - Virtual size: 656KB

.rdata
Size: 148KB - Virtual size: 148KB

.data
Size: 15KB - Virtual size: 57KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 32KB - Virtual size: 32KB