57258da85f8371a9b6e4e2f97ea18304

Sharing

Copy URL Twitter E-mail

General

Target

57258da85f8371a9b6e4e2f97ea18304
Size

162KB
MD5

57258da85f8371a9b6e4e2f97ea18304
SHA1

ffa8144ced06890cbc7f322135195d4a3e89f9ad
SHA256

aa2a2ebc5f37d794698d950e2fedef575dc312a75276c648448a0c467734fd45
SHA512

1029025784c0a00645ed2a81e783f2ce64878774508cc6969a352335510c59da4e44267cad70590c6c6a5962f4c0bd6b4ca081ca7995d4f0bfaf96fc49c977b2
SSDEEP

3072:2TQSddIv+gtxiH7q9cNSFDUYZPEZqAsshCV/7sc0boJ3JYklTaFkb27ca:kQ2de+8aqzDN6ZkGe700ima0+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
57258da85f8371a9b6e4e2f97ea18304

Files

57258da85f8371a9b6e4e2f97ea18304
.dll windows:5 windows x86 arch:x86

08156c9166e5edc8d0b553ca0bfc8c61

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

malloc
_adjust_fdiv
_initterm
_strnicmp
isdigit
wcscpy
wcscat
free
memmove
toupper
_stricmp
wcslen
_strupr
strchr
wcschr
strncpy

ntdll

RtlAnsiStringToUnicodeString
RtlInitUnicodeString
RtlOemToUnicodeN
NtOpenThreadToken
NtImpersonateAnonymousToken
NtCreateFile
NtFsControlFile
NtSetInformationThread
RtlUnicodeToOemN
NlsMbOemCodePageTag
RtlxUnicodeStringToOemSize
RtlUnicodeStringToOemString
NtOpenProcessToken
NtQueryInformationToken
RtlCopyLuid
NtClose
RtlAllocateHeap
RtlFreeHeap
RtlInitAnsiString
RtlUnicodeStringToAnsiString
RtlFreeUnicodeString
RtlNtStatusToDosError
RtlUnicodeToMultiByteN

advapi32

SystemFunction006
SystemFunction016
SystemFunction012

kernel32

GetCurrentProcessId
QueryPerformanceCounter
ResetEvent
SetThreadPriority
LoadLibraryA
GetProcAddress
LocalReAlloc
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
VirtualProtect
DeleteCriticalSection
CreateThread
VirtualAlloc
SetLastError
CreateEventA
TransactNamedPipe
SetUnhandledExceptionFilter
GetModuleHandleA
LocalFree
CloseHandle
GetMailslotInfo
CreateMailslotA
LocalAlloc
ReadFile
SetMailslotInfo
WriteFile
CreateFileA
GetNamedPipeInfo
GetNamedPipeHandleStateA
SetNamedPipeHandleState
GetTickCount
PeekNamedPipe
CallNamedPipeA
WaitNamedPipeA
LeaveCriticalSection
SetEvent
EnterCriticalSection
GetComputerNameA
GetCurrentThreadId
GetOverlappedResult
WaitForSingleObject
GetLastError

netapi32

Netbios
NetWkstaUserGetInfo
NetWkstaGetInfo
NetapipBufferAllocate
I_NetNameCanonicalize
NetApiBufferFree

ntvdm.exe

setCF
setAX
setDX
setDI
setES
getBX
setSI
setCX
setBX
getCX
getDX
getES
getDI
getDS
getSI
getBP
WaitIfIdle
setZF
setAL
getMSW
Sim32pGetVDMPointer
setBL
setBH
getDL
getDH
getAL
getBL
VDDInstallUserHook
getCS
SoftPcEoi
call_ica_hw_interrupt
setDS
getAX

xactsrv

XsNetMessageBufferSend
XsNetServiceControl
XsNetUseAdd
XsNetUseDel
XsNetUseEnum
XsNetUseGetInfo
XsNetWkstaGetInfo
XsNetServerEnum2

netrap

RapTotalSize
RapStructureSize
RapAuxDataCount
RapConvertSingleEntryEx
RapConvertSingleEntry
RapParmNumDescriptor
RapGetFieldSize
RapArrayLength
RapStructureAlignment
RapAsciiToDecimal
RapAuxDataCountOffset

Exports

Exports

ServiceMain
VrCancelPipeIo
VrConvertLocalNtPipeName
VrDispatch
VrInitialized
VrIsNamedPipeHandle
VrIsNamedPipeName
VrReadNamedPipe
VrRemoveOpenNamedPipeInfo
VrWriteNamedPipe

Sections

.text
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 113KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

08156c9166e5edc8d0b553ca0bfc8c61

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

advapi32

kernel32

netapi32

ntvdm.exe

xactsrv

netrap

Exports

Exports

Sections

.text Size: 44KB - Virtual size: 43KB

.data Size: 1KB - Virtual size: 10KB

.rsrc Size: 113KB - Virtual size: 113KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 44KB - Virtual size: 43KB

.data
Size: 1KB - Virtual size: 10KB

.rsrc
Size: 113KB - Virtual size: 113KB

.reloc
Size: 2KB - Virtual size: 2KB