57d67fa99117fea9c5245fb3485432d2

Sharing

Copy URL Twitter E-mail

General

Target

57d67fa99117fea9c5245fb3485432d2
Size

142KB
MD5

57d67fa99117fea9c5245fb3485432d2
SHA1

3bf274494c661ba9c336bbe696e379404494f94a
SHA256

6726de0e5cdefc68387a7ce3d9595fdd29c48ff2efc0175893e6067806954e98
SHA512

7476ab833e8c7ca6deddc8a7a37b27828b1ff0b7f4f42d0579bf68d77d850c557b8c0c990b14783c46d91dfca1e3dc48a5c370e557d3d4478cf20ce4f875c2af
SSDEEP

3072:kfeCmVyE+2dyfPJVwz6/73NYoJuYmruBbkSk+IBEpzAOgTfpLo:kfelvXdyfPv71rnP2WzApThL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
57d67fa99117fea9c5245fb3485432d2

Files

57d67fa99117fea9c5245fb3485432d2
.exe windows:5 windows x86 arch:x86

afb17334fe4a38684001b4e20a137a1b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

rtutils

RouterGetErrorStringW
RouterLogDeregisterW
LogErrorW
LogEventW
TracePrintfA
MprSetupProtocolEnum
TraceDeregisterW
RouterLogDeregisterA
RouterLogEventValistExA
RouterLogEventDataA
TraceGetConsoleA
RouterLogEventExW
TracePrintfExA
RouterGetErrorStringA
TraceVprintfExW
TraceRegisterExW
TraceDumpExW
TraceDeregisterA
TracePutsExW
RouterLogRegisterW
TraceRegisterExA
RouterLogEventA
RouterLogEventStringW
TracePrintfExW
TraceDumpExA
RouterLogEventDataW
RouterAssert
TraceGetConsoleW
TraceVprintfExA
LogEventA
RouterLogEventW
RouterLogEventExA
RouterLogEventStringA
RouterLogEventValistExW
TracePrintfW
TraceDeregisterExW
TraceDeregisterExA
LogErrorA
RouterLogRegisterA
TracePutsExA
MprSetupProtocolFree

dhcpsapi

DhcpCreateSubnet
DhcpEnumMScopeClients
DhcpGetOptionInfo
DhcpRemoveOption
DhcpGetAllOptionValues
DhcpDsClearHostServerEntries
DhcpServerGetConfigV4
DhcpEnumMScopes
DhcpSetMScopeInfo
DhcpRemoveOptionValueV5
DhcpEnumSubnetElementsV5
DhcpEnumOptionsV5
DhcpDeleteMClientInfo
DhcpSetOptionValueV5
DhcpEnumSubnetClientsV5
DhcpEnumSubnets
DhcpEnumSubnetClients
DhcpEnumMScopeElements
DhcpSetSuperScopeV4
DhcpRemoveSubnetElementV5
DhcpCreateOptionV5
DhcpServerRestoreDatabase
DhcpGetMibInfo
DhcpAuditLogSetParams
DhcpSetSubnetInfo
DhcpServerBackupDatabase
DhcpEnumOptions
DhcpGetClientInfoV4
DhcpSetOptionValue
DhcpServerSetDnsRegCredentials
DhcpServerRedoAuthorization
DhcpSetOptionInfo
DhcpCreateOption
DhcpDeleteSuperScopeV4
DhcpDeleteClass
DhcpGetOptionValue
DhcpGetOptionInfoV5
DhcpGetMCastMibInfo
DhcpAddMScopeElement
DhcpAddServer
DhcpGetAllOptions
DhcpGetClientInfo
DhcpCreateClass

ntlanman

NPGetConnection3
NPGetCaps
NPGetConnectionPerformance
NPGetConnection
NPGetUser
NPCancelConnection
NPGetResourceInformation
NPAddConnection3
DllMain
NPGetResourceParent
NPCloseEnum
NPFormatNetworkName
NPOpenEnum
NPAddConnection
I_SystemFocusDialog
NPGetReconnectFlags
NPEnumResource
NPGetUniversalName

msi

MsiUseFeatureA
MsiGetSourcePathW
MsiViewGetErrorA
MsiRecordClearData
MsiProvideQualifiedComponentA
MsiDatabaseApplyTransformA
MsiUseFeatureExW
MsiViewExecute
MsiCreateRecord
MsiOpenPackageA
MsiGetProductInfoFromScriptW
MsiEnumProductsA
MsiQueryFeatureStateFromDescriptorA
MsiSetInstallLevel
MsiSetFeatureStateA
Migrate10CachedPackagesA
MsiGetProductPropertyA
MsiInstallMissingComponentW
MsiProvideAssemblyW
MsiPreviewDialogW
MsiSetFeatureAttributesA
MsiOpenProductW
MsiGetProductInfoA
MsiRecordGetStringA
MsiReinstallFeatureFromDescriptorA

imm32

ImmSimulateHotKey
ImmIMPQueryIMEW
ImmGetStatusWindowPos
ImmProcessKey
ImmGetOpenStatus
ImmIsIME
ImmGetDescriptionA
ImmRequestMessageA
ImmIMPSetIMEW
ImmGetIMCLockCount
ImmSetCompositionWindow
ImmRegisterClient
ImmRequestMessageW
ImmUnlockImeDpi
ImmGetContext
ImmCreateIMCC
ImmGetConversionStatus
ImmGetCompositionStringA
ImmGetImeMenuItemsW
ImmGetCompositionStringW
ImmReSizeIMCC
ImmAssociateContext
ImmUnregisterWordW
ImmGetConversionListW
ImmLockIMC
ImmSetConversionStatus
ImmGetCandidateListCountW
ImmGetCandidateListA
ImmIMPSetIMEA
ImmLoadLayout
ImmEscapeW
ImmGetRegisterWordStyleA
ImmGetProperty
ImmActivateLayout
ImmIMPGetIMEA
ImmSendIMEMessageExA

gdi32

EngCreateClip
EnumFontFamiliesExA
ScaleViewportExtEx
CloseFigure
GetCharWidthInfo
EngDeletePalette
PolyPolyline
GetGlyphIndicesA
GdiSetBatchLimit
EnumMetaFile
SetColorSpace
CreateBrushIndirect
GdiConvertDC
CreateEllipticRgnIndirect
CreateHatchBrush
GetKerningPairs
GetTransform
GetCharWidth32A
PolyPatBlt
GetObjectType
RoundRect
EnumFontFamiliesExW
ExtFloodFill
AnyLinkedFonts
STROBJ_vEnumStart
FONTOBJ_cGetGlyphs
RemoveFontResourceExW
DdEntry28
DdEntry43
GetCharWidthI
DdEntry6
CopyEnhMetaFileA
GetGlyphOutlineA
GetGlyphOutlineWow
SetBitmapDimensionEx
GetMiterLimit
GetEnhMetaFileHeader
FillPath
DdEntry8

kernel32

GetExitCodeProcess
GetStartupInfoA
UnregisterConsoleIME
HeapDestroy
GetVolumePathNameW
RegisterWowBaseHandlers
SetFileApisToOEM
LoadLibraryA
GlobalHandle
UnregisterWaitEx
SetCurrentDirectoryA
FlushViewOfFile
EnterCriticalSection
GetConsoleProcessList
GetBinaryTypeW
QueryPerformanceFrequency
SetLocaleInfoW
CopyFileExA
GetProcessVersion
LeaveCriticalSection
EnumDateFormatsExA
EnumCalendarInfoW
GetDiskFreeSpaceExA
GetTimeZoneInformation
SetMessageWaitingIndicator
BaseDumpAppcompatCache
SetThreadExecutionState
GetLogicalDrives
GetFileAttributesW
FindNextChangeNotification
GetConsoleInputWaitHandle
GetPrivateProfileIntA
GlobalAddAtomW
GetConsoleAliasExesA
EnumCalendarInfoA
OpenEventA
CreateNamedPipeA
InitializeSListHead
WriteConsoleOutputAttribute
MoveFileWithProgressW
VirtualAlloc
_lopen
SetFileTime
GetFileType
GetConsoleKeyboardLayoutNameA
SetConsoleActiveScreenBuffer
DeleteCriticalSection

msvcrt20

gmtime
_mtlock
_wputenv
_strnicmp
_wcsicmp
_umask
?is_open@fstream@@QBEHXZ
strerror
_ismbstrail
??0stdiostream@@QAE@PAU_iobuf@@@Z
__p__pgmptr
?str@istrstream@@QAEPADXZ
__p__fmode
toupper
_ismbcl0
??_Gfilebuf@@UAEPAXI@Z
?is_open@ofstream@@QBEHXZ
tanh
?lockc@ios@@KAXXZ
_wcmdln
_getche
?rdbuf@ostrstream@@QBEPAVstrstreambuf@@XZ
?sync@stdiobuf@@UAEHXZ
__p__acmdln
malloc
$I10_OUTPUT
??0strstream@@QAE@PADHH@Z
??_7fstream@@6B@
??_Dfstream@@QAEXXZ
_chdir
??4strstream@@QAEAAV0@AAV0@@Z
??_7ostream_withassign@@6B@
?unexpected@@YAXXZ
_endthread
_fputchar
_swab
_adj_fdiv_m32
??5istream@@QAEAAV0@AAD@Z
wcsspn
??_8iostream@@7Bostream@@@
?x_statebuf@ios@@0QAJA

Sections

.text
Size: 53KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

afb17334fe4a38684001b4e20a137a1b

Headers

DLL Characteristics

File Characteristics

Imports

rtutils

dhcpsapi

ntlanman

msi

imm32

gdi32

kernel32

msvcrt20

Sections

.text Size: 53KB - Virtual size: 52KB

.rdata Size: 71KB - Virtual size: 71KB

.data Size: 12KB - Virtual size: 188KB

.rsrc Size: 3KB - Virtual size: 3KB

.reloc Size: 1024B - Virtual size: 976B

.text
Size: 53KB - Virtual size: 52KB

.rdata
Size: 71KB - Virtual size: 71KB

.data
Size: 12KB - Virtual size: 188KB

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 1024B - Virtual size: 976B