c3006b9ef4c3f051695101ecd1daf4c3ede7dc2ca1df79ad9e5b48e8cb603965

Sharing

Copy URL Twitter E-mail

General

Target

c3006b9ef4c3f051695101ecd1daf4c3ede7dc2ca1df79ad9e5b48e8cb603965
Size

3.5MB
MD5

87c5867c4d1ca21deb64d80d53ecdec4
SHA1

63c748ebdf9d634f3a34fc4642b7b68d668d801d
SHA256

c3006b9ef4c3f051695101ecd1daf4c3ede7dc2ca1df79ad9e5b48e8cb603965
SHA512

0098e4d334f7def3c0d3b1ccb4114fe1d620016dca4c6f0c796ee89d025508482da9fe47d1ddde4377aab69e91d96592f0ed54c4f7bef3b4124e0f395e424c35
SSDEEP

98304:QXS3QGoltLvlU57o3A2SP01QFJv27LE54QYsxaMaknE9ZrU98JkOfF:QXS3QGoltL3Mr+7o5vnE9ZU8JkOfF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c3006b9ef4c3f051695101ecd1daf4c3ede7dc2ca1df79ad9e5b48e8cb603965

Files

c3006b9ef4c3f051695101ecd1daf4c3ede7dc2ca1df79ad9e5b48e8cb603965
.dll windows:6 windows x86

b40de4529d82598183d017c9b4f5994d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

sangfordll

LoginSslVpnByUsrPwd
QueryTcpServiceStatus
LogoutSslVpn
QueryL3vpnServiceStatus

crypt32

CertGetCertificateContextProperty
CertFreeCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore

atrustsdk

atrust_sync_logout
atrust_initial
atrust_sync_query_status
atrust_uninitial
atrust_sync_login_by_pwd
atrust_free

kernel32

WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
InitializeSListHead
WriteConsoleW
MoveFileExW
GetConsoleOutputCP
SetFilePointerEx
LCMapStringW
VirtualQuery
VirtualAlloc
HeapQueryInformation
SetStdHandle
FreeLibraryAndExitThread
ExitThread
GetFileInformationByHandle
GetDriveTypeW
SetConsoleCtrlHandler
ExitProcess
GetCommandLineW
GetCommandLineA
InterlockedFlushSList
RtlUnwind
GetCPInfo
GetStringTypeW
OutputDebugStringW
GlobalFindAtomW
CompareStringW
GlobalFlags
GetTempFileNameW
SearchPathW
GetProfileIntW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetTempPathW
FindResourceExW
lstrcpyW
CreateThread
VirtualProtect
GetACP
IsValidCodePage
FindFirstFileExW
SizeofResource
LockResource
LoadResource
FindResourceW
WinExec
GetPrivateProfileStringW
WritePrivateProfileStringW
CopyFileW
HeapAlloc
GetProcessHeap
HeapFree
lstrlenW
GetLastError
QueryPerformanceFrequency
QueryPerformanceCounter
GetExitCodeThread
TerminateThread
WaitForSingleObject
ResumeThread
Sleep
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
CloseHandle
MultiByteToWideChar
lstrlenA
InitializeCriticalSectionAndSpinCount
HeapSize
HeapReAlloc
RaiseException
DecodePointer
DeleteCriticalSection
GetCurrentThreadId
GetCurrentProcessId
GetModuleFileNameA
GetLocalTime
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
GetCurrentDirectoryW
GetSystemDirectoryW
EncodePointer
SetErrorMode
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
GetFileSizeEx
GetFileAttributesExW
GetFileAttributesW
SystemTimeToTzSpecificLocalTime
FileTimeToLocalFileTime
lstrcmpiW
UnlockFile
SetFilePointer
SetEndOfFile
LockFile
GetVolumeInformationW
GetFullPathNameW
GetFileSize
FlushFileBuffers
MulDiv
GlobalUnlock
GlobalSize
GlobalAddAtomW
GetPrivateProfileIntW
SuspendThread
SetThreadPriority
lstrcmpW
lstrcmpA
GlobalDeleteAtom
GlobalLock
GetModuleHandleA
GetCurrentThread
OutputDebugStringA
GetSystemTime
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
FindNextFileW
LoadLibraryA
ConvertFiberToThread
GetSystemTimeAsFileTime
MoveFileA
DeleteFileA
GetEnvironmentVariableW
WideCharToMultiByte
DeleteFiber
GetModuleHandleExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetLastError
GetFileType
GetStdHandle
SetEvent
ResetEvent
CreateEventW
FileTimeToSystemTime
SystemTimeToFileTime
WriteFile
DuplicateHandle
ReadFile
PeekNamedPipe
CreateProcessW
GetStartupInfoW
TerminateProcess
GetExitCodeProcess
OpenProcess
Process32NextW
Process32FirstW
InitializeCriticalSectionEx
GetTimeZoneInformation
GetFileTime
CreateToolhelp32Snapshot
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
LoadLibraryW
LoadLibraryExW
WTSGetActiveConsoleSessionId
FreeLibrary
CreateFileW
GlobalFree
GlobalAlloc
GetSystemInfo
GetCurrentProcess
GetModuleHandleW
GetProcAddress
GetVersionExW
VerifyVersionInfoW
VerSetConditionMask
FormatMessageW
LocalFree
DeleteFileW
GetTickCount
GetModuleFileNameW
FindClose
FindFirstFileW
GetWindowsDirectoryW
GlobalGetAtomNameW

user32

MonitorFromPoint
UpdateLayeredWindow
UnionRect
DrawIcon
FrameRect
CopyIcon
SetCursorPos
BringWindowToTop
GetSystemMenu
IsZoomed
DrawFrameControl
DrawEdge
SetParent
SetWindowRgn
SetClassLongW
DrawStateW
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
EnumDisplayMonitors
SetLayeredWindowAttributes
LoadMenuW
GetKeyNameTextW
MapVirtualKeyW
GetMenuDefaultItem
CreatePopupMenu
NotifyWinEvent
InvertRect
HideCaret
EnableScrollBar
MessageBeep
GetIconInfo
DrawIconEx
IsRectEmpty
DrawFocusRect
WindowFromPoint
ReleaseCapture
SetCapture
GetNextDlgGroupItem
LoadImageW
TrackMouseEvent
MapDialogRect
GetAsyncKeyState
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamW
OffsetRect
SetRectEmpty
SendDlgItemMessageA
TranslateAcceleratorW
InsertMenuItemW
LoadAcceleratorsW
UnregisterClassW
GetMenuItemInfoW
DestroyMenu
IntersectRect
InflateRect
DestroyIcon
LoadCursorW
GetSysColorBrush
IsDialogMessageW
CheckDlgButton
MoveWindow
ShowWindow
GetMonitorInfoW
MonitorFromWindow
WinHelpW
UnpackDDElParam
SetScrollInfo
LoadIconW
GetTopWindow
GetClassLongW
SetWindowLongW
EqualRect
CopyRect
MapWindowPoints
AdjustWindowRectEx
GetWindowTextLengthW
RemovePropW
GetPropW
SetPropW
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
RedrawWindow
SetForegroundWindow
GetForegroundWindow
SetActiveWindow
TrackPopupMenu
SetMenu
GetMenu
GetCapture
SetFocus
GetDlgItem
IsIconic
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
ReuseDDElParam
GetComboBoxInfo
PostThreadMessageW
WaitMessage
GetKeyboardLayout
IsCharLowerW
MapVirtualKeyExW
ToUnicodeEx
GetKeyboardState
CreateAcceleratorTableW
DestroyAcceleratorTable
CopyAcceleratorTableW
SetRect
LockWindowUpdate
SetMenuDefaultItem
GetDoubleClickTime
ModifyMenuW
RegisterClipboardFormatW
CharUpperBuffW
IsClipboardFormatAvailable
GetUpdateRect
DrawMenuBar
DefFrameProcW
FindWindowA
SendMessageW
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
PostMessageW
PostQuitMessage
GetFocus
CheckMenuItem
EnableMenuItem
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
SetMenuItemInfoW
GetParent
LoadBitmapW
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
IsWindowVisible
GetActiveWindow
GetKeyState
ValidateRect
GetCursorPos
SetWindowsHookExW
CallNextHookEx
ShowOwnedPopups
SetCursor
EnableWindow
IsWindowEnabled
GetWindowLongW
GetWindowThreadProcessId
GetLastActivePopup
GetMenuStringW
GetMenuState
GetSubMenu
GetMenuItemID
GetMenuItemCount
InsertMenuW
AppendMenuW
RemoveMenu
UnhookWindowsHookEx
CharUpperW
GetSystemMetrics
DrawTextW
DrawTextExW
GrayStringW
TabbedTextOutW
DefMDIChildProcW
TranslateMDISysAccel
SubtractRect
CreateMenu
GetClassInfoW
GetWindowRgn
DestroyCursor
GetScrollInfo
GetDC
GetWindowDC
ReleaseDC
BeginPaint
EndPaint
ClientToScreen
ScreenToClient
GetSysColor
FillRect
GetClientRect
CopyImage
SystemParametersInfoW
DeleteMenu
GetDlgCtrlID
SetWindowTextW
GetWindowTextW
GetWindowRect
PtInRect
GetDesktopWindow
GetClassNameW
GetWindow
RealChildWindowFromPoint
SetTimer
KillTimer
UpdateWindow
InvalidateRect
RegisterWindowMessageW
GetMessagePos
GetMessageTime
DefWindowProcW
CallWindowProcW
SetWindowPlacement
GetWindowPlacement
SetWindowPos
DestroyWindow
IsChild
IsMenu
IsWindow
CreateWindowExW
GetClassInfoExW
RegisterClassW

gdi32

GetObjectW
MoveToEx
TextOutW
ExtTextOutW
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CombineRgn
CreateFontIndirectW
CreateRectRgnIndirect
PatBlt
SetRectRgn
DPtoLP
GetTextExtentPoint32W
GetTextMetricsW
EnumFontFamiliesExW
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
RealizePalette
GetBkColor
CreateCompatibleBitmap
CreateDIBitmap
GetTextCharsetInfo
StretchBlt
CreateDIBSection
SetDIBColorTable
CreateEllipticRgn
Ellipse
GetTextColor
CreatePolygonRgn
Polygon
Polyline
CreateRoundRectRgn
LPtoDP
Rectangle
GetRgnBox
OffsetRgn
RoundRect
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
ExtFloodFill
SetPaletteEntries
SetPixelV
GetWindowOrgEx
GetViewportOrgEx
GetTextFaceW
EnumFontFamiliesW
CreateBitmap
CopyMetaFileW
CreateDCW
GetDeviceCaps
BitBlt
CreateCompatibleDC
CreateHatchBrush
CreatePen
CreatePatternBrush
CreateRectRgn
CreateSolidBrush
DeleteDC
DeleteObject
Escape
ExcludeClipRect
GetClipBox
GetObjectType
GetPixel
GetStockObject
GetViewportExtEx
GetWindowExtEx
LineTo
PtVisible
RectVisible
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectObject
SelectPalette
SetBkColor
SetBkMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetTextColor
SetTextAlign
SetPixel
IntersectClipRect

msimg32

TransparentBlt
AlphaBlend

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

advapi32

RegQueryInfoKeyW
RegCloseKey
RegEnumValueW
RegEnumKeyExW
RegSetValueExW
RegQueryValueExW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegQueryValueW
RegEnumKeyW
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegOpenKeyExW
LookupAccountSidW
GetTokenInformation
OpenProcessToken
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
GetUserNameW

shell32

ShellExecuteW
SHGetSpecialFolderPathW
SHGetFileInfoW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHAppBarMessage
SHBrowseForFolderW
DragFinish
DragQueryFileW
SHGetDesktopFolder

shlwapi

PathFindExtensionW
PathFindFileNameW
PathIsUNCW
PathStripToRootW
PathRemoveFileSpecW
StrFormatKBSizeW

uxtheme

DrawThemeText
DrawThemeParentBackground
OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemeColor
GetCurrentThemeName
GetWindowTheme
IsAppThemed
IsThemeBackgroundPartiallyTransparent
GetThemeSysColor
GetThemePartSize

ole32

RegisterDragDrop
RevokeDragDrop
OleLockRunning
OleCreateMenuDescriptor
OleTranslateAccelerator
IsAccelerator
CoLockObjectExternal
OleGetClipboard
DoDragDrop
CreateStreamOnHGlobal
CoDisconnectObject
ReleaseStgMedium
OleDuplicateData
CoTaskMemFree
CoTaskMemAlloc
CoCreateGuid
CoInitializeEx
CoCreateInstance
CoUninitialize
CoInitialize
OleDestroyMenuDescriptor

oleaut32

VariantInit
SysAllocStringLen
VariantChangeType
LoadTypeLi
SysStringLen
VariantCopy
VarBstrFromDate
SystemTimeToVariantTime
VariantTimeToSystemTime
VariantClear
SysAllocString
SysFreeString

winmm

PlaySoundW

ws2_32

WSASetLastError
inet_addr
htons
WSAStartup
WSAGetLastError
gethostbyname
WSACleanup
getaddrinfo
freeaddrinfo
WSASocketW
setsockopt
closesocket
sendto
recvfrom
socket
bind
listen
accept
connect
select
send
recv
getsockname
gethostbyaddr

wtsapi32

WTSQuerySessionInformationW
WTSFreeMemory

rasapi32

RasHangUpW
RasGetProjectionInfoW
RasEnumConnectionsW
RasGetErrorStringW

bcrypt

BCryptGenRandom

gdiplus

GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipDrawImageRectI
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipFree
GdipAlloc
GdiplusShutdown
GdipSetInterpolationMode
GdipGetImagePaletteSize

oleacc

AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject

imm32

ImmGetOpenStatus
ImmReleaseContext
ImmGetContext

Exports

Exports

CreateNetworkInstance
DestroyNetworkInstance

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 753KB - Virtual size: 753KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 37KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 189KB - Virtual size: 189KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b40de4529d82598183d017c9b4f5994d

Headers

DLL Characteristics

File Characteristics

Imports

sangfordll

crypt32

atrustsdk

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

shlwapi

uxtheme

ole32

oleaut32

winmm

ws2_32

wtsapi32

rasapi32

bcrypt

gdiplus

oleacc

imm32

Exports

Exports

Sections

.text Size: 2.5MB - Virtual size: 2.5MB

.rdata Size: 753KB - Virtual size: 753KB

.data Size: 37KB - Virtual size: 69KB

.rsrc Size: 16KB - Virtual size: 16KB

.reloc Size: 189KB - Virtual size: 189KB

.text
Size: 2.5MB - Virtual size: 2.5MB

.rdata
Size: 753KB - Virtual size: 753KB

.data
Size: 37KB - Virtual size: 69KB

.rsrc
Size: 16KB - Virtual size: 16KB

.reloc
Size: 189KB - Virtual size: 189KB