0c78d5e008f5a96c9c46b345825f82287999754198414b105fdcd342fe727207

Sharing

Copy URL

Twitter E-mail

General

Target

0c78d5e008f5a96c9c46b345825f82287999754198414b105fdcd342fe727207
Size

1013KB
MD5

aaad857f1f14835b745ccfe77d3c584e
SHA1

a0864b40a1edf6396d11e07b8f7844532f997dc9
SHA256

0c78d5e008f5a96c9c46b345825f82287999754198414b105fdcd342fe727207
SHA512

95ad36c2114dd030773229950656d249ae3718424765b57efd4e323438fc768005baae5cbcd896aa13f074bbb855274cd8c779cb9c34550cf108849119de21d4
SSDEEP

24576:8KIy4kdGtp6cg9IvQQ5uEFnfInNteT+7b1Bt4bOhsVfKb:8I4kdGtp6cg9GZIztThGSb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0c78d5e008f5a96c9c46b345825f82287999754198414b105fdcd342fe727207

Files

0c78d5e008f5a96c9c46b345825f82287999754198414b105fdcd342fe727207
.dll windows:6 windows x86

1ed9ca9e3bb971cd02d13c957a5fbfe7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

wsprintfW

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW

shlwapi

PathFileExistsA
StrStrW

shell32

CommandLineToArgvW

ws2_32

htons
getsockopt
select
connect
closesocket
shutdown
send
setsockopt
socket
gethostbyname
WSAStartup
WSAGetLastError
recv
ioctlsocket

kernel32

InitializeCriticalSectionEx
DecodePointer
WriteConsoleW
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetConsoleOutputCP
GetFileType
GetStdHandle
ReadConsoleW
GetConsoleMode
Sleep
CreateIoCompletionPort
PostQueuedCompletionStatus
CloseHandle
GetQueuedCompletionStatus
FindFirstFileW
RemoveDirectoryW
DeleteFileW
FindNextFileW
FindClose
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
LoadLibraryExA
GetLastError
GetProcAddress
FreeLibrary
CreateEventA
SetEvent
ResetEvent
WaitForSingleObject
AreFileApisANSI
ReadFile
TryEnterCriticalSection
HeapCreate
HeapFree
GetFullPathNameW
WriteFile
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
CreateFileW
GetFileAttributesW
GetCurrentThreadId
UnmapViewOfFile
HeapValidate
HeapSize
MultiByteToWideChar
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
CreateFileA
LoadLibraryA
WaitForSingleObjectEx
DeleteFileA
HeapReAlloc
GetSystemInfo
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
LocalFree
LockFileEx
GetFileSize
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
GetCurrentProcess
TerminateProcess
GetModuleHandleW
GetFileSizeEx
FindFirstFileA
ExpandEnvironmentStringsW
CreateEventW
TerminateThread
CreateThread
GetCommandLineW
GetModuleFileNameW
GetLocalTime
GetTimeZoneInformation
GetModuleFileNameA
InitializeCriticalSectionAndSpinCount
SetCriticalSectionSpinCount
GetPrivateProfileIntA
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
CreateDirectoryA
GetLongPathNameA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
SetFilePointerEx
GetTempPathA
CreateDirectoryW
RtlUnwind
RaiseException
InterlockedFlushSList
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
CompareStringW
LCMapStringW

Exports

Exports

?MAP_ANALYZE_ADDR_Cancel_Query@@YGHHNNPBX@Z
?MAP_ANALYZE_ADDR_Cancel_Query_Batch@@YGHHQAU_tagQueryLonLatInfo@@H@Z
MAP_ANALYZE_ADDR_Free
MAP_ANALYZE_ADDR_Init
MAP_ANALYZE_ADDR_Query
MAP_ANALYZE_ADDR_Query_Batch
MAP_ANALYZE_ADDR_SetCallBack
MAP_ANALYZE_ADDR_SetCircleRange
MAP_ANALYZE_ADDR_SetLoginSvrInfo
MAP_ANALYZE_ADDR_SetSessionInfo
MAP_ANALYZE_ADDR_StartWork
MAP_ANALYZE_ADDR_StopWork
MAP_ANALYZE_ADDR_Update

Sections

.text
Size: 858KB - Virtual size: 858KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 116KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1ed9ca9e3bb971cd02d13c957a5fbfe7

Headers

DLL Characteristics

File Characteristics

Imports

user32

advapi32

shlwapi

shell32

ws2_32

kernel32

Exports

Exports

Sections

.text Size: 858KB - Virtual size: 858KB

.rdata Size: 116KB - Virtual size: 115KB

.data Size: 10KB - Virtual size: 16KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 25KB - Virtual size: 25KB

.text
Size: 858KB - Virtual size: 858KB

.rdata
Size: 116KB - Virtual size: 115KB

.data
Size: 10KB - Virtual size: 16KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 25KB - Virtual size: 25KB