2024-01-27_e3e0285599b9e5623a7abfa4426cfdbb_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-01-27_e3e0285599b9e5623a7abfa4426cfdbb_ryuk
Size

14.4MB
MD5

e3e0285599b9e5623a7abfa4426cfdbb
SHA1

e3f48ef5a1006545033bb9b30596b8db212c29e5
SHA256

ae1a5e7686588090c513368802f99b99aa86204d16b27e35929e746864acd745
SHA512

f7ebab5c76ed6ccf3b94b551e1a196bf00f147d0559cd25e5215c3f7934225855f5174caac34953d303009a4c640805e74eaa61e9c795b04f57fcaf983f8d981
SSDEEP

196608:3M73A9k89xaKCImYTubZNpe3UOpIpsr7DXKUE5JCiNlsbYHity3qSL:3zSKjUZapT/D5ONgqiQDL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-01-27_e3e0285599b9e5623a7abfa4426cfdbb_ryuk

Files

2024-01-27_e3e0285599b9e5623a7abfa4426cfdbb_ryuk
.exe windows:5 windows x64 arch:x64

8cf79ffe5d2e3d0b4bc671d915662670

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\development\svn\build\products\eventsentry\5_0\agent\build\ReleaseLight.x64\eventsentry_svc.pdb

Imports

iphlpapi

GetIpForwardTable
CancelIPChangeNotify
GetAdaptersInfo
NotifyAddrChange

netapi32

NetApiBufferFree
DsRoleFreeMemory
DsRoleGetPrimaryDomainInformation

pdh

PdhCloseQuery
PdhAddCounterA
PdhOpenQueryA
PdhLookupPerfNameByIndexA
PdhGetFormattedCounterArrayA
PdhLookupPerfNameByIndexW
PdhLookupPerfIndexByNameW
PdhCollectQueryData
PdhGetFormattedCounterValue

rpcrt4

UuidToStringA
RpcStringFreeA

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

winmm

sndPlaySoundA

ws2_32

closesocket
bind
accept
ioctlsocket
htonl
htons
inet_addr
inet_ntoa
listen
ntohs
recvfrom
select
send
sendto
setsockopt
socket
gethostbyname
gethostname
__WSAFDIsSet
connect
WSAStartup
WSACleanup
WSAGetLastError
WSAIoctl
WSACreateEvent
recv
gethostbyaddr
getservbyport
getservbyname
WSASetLastError
WSASocketA
WSARecv
WSASend
WSACancelBlockingCall
getsockopt
WSAAsyncSelect
WSAAsyncGetHostByName
WSAAsyncGetHostByAddr
WSAAsyncGetServByName
WSAAsyncGetServByPort
WSAIsBlocking
ntohl
getsockname
WSACancelAsyncRequest
getpeername

chartdir51

Box2DrawObj
LineLayer2Layer
CBox_setBackground
TextBox2Box
CBaseChart_destroy
CBaseChart_getHeight
CBaseChart_setBackground
CBaseChart_setBorder
CBaseChart_addTitle
CBaseChart_addText
CBaseChart_patternColor
CBaseChart_linearGradientColor
CBaseChart_setDefaultFonts
CBaseChart_makeChart2
CAxis_setLabelStyle
CXYChart_yAxis2
CXYChart_xAxis
CXYChart_xAxis2
CAxis_setColors
CAxis_setWidth
CXYChart_setPlotArea
CXYChart_addLineLayer2
CXYChart_addSplineLayer
CArrayMath_create
CArrayMath_destroy
CArrayMath_lowess
CArrayMath_result
CXYChart_yAxis
CXYChart_create
XYChart2BaseChart
SplineLayer2LineLayer
CAxis_setLabels
CAxis_setLabelStep
CDataSet_setDataSymbol
CLayer_setLineWidth
CLayer_addDataSet
CLayer_addCustomDataLabel
CChart_setLicenseCode
CAxis_setTitle

kernel32

SetFileTime
CloseHandle
HeapAlloc
HeapFree
GetProcessHeap
FileTimeToDosDateTime
DosDateTimeToFileTime
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryA
LocalFree
InitializeCriticalSection
ReadFile
GetSystemTime
Sleep
CreateThread
TerminateThread
DecodePointer
RaiseException
HeapReAlloc
HeapSize
SetEndOfFile
SetFilePointer
WriteFile
GetTickCount
WaitForSingleObject
GetTimeZoneInformation
GetDriveTypeA
GetLogicalDrives
GetVolumeInformationA
CreatePipe
PeekNamedPipe
GetProcessTimes
GetCurrentProcess
GetExitCodeProcess
CreateProcessA
GetStartupInfoA
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SystemTimeToFileTime
CreateFileW
LocalAlloc
lstrcmpA
DeviceIoControl
CreateDirectoryA
FormatMessageA
GetComputerNameExA
GetSystemDirectoryA
DuplicateHandle
DeleteFileA
GetDiskFreeSpaceExA
GetFileSizeEx
CopyFileA
ReleaseMutex
ExpandEnvironmentStringsA
FindCloseChangeNotification
FindFirstChangeNotificationA
FindNextChangeNotification
GetFileAttributesA
GetFileSize
RemoveDirectoryA
GetTempPathA
CreateIoCompletionPort
PostQueuedCompletionStatus
LocalFileTimeToFileTime
CreateMutexA
CreateEventA
WaitForMultipleObjects
GetCurrentThread
GetCurrentThreadId
SetThreadPriority
ExitThread
GetExitCodeThread
GetSystemTimeAsFileTime
GetLocalTime
GetModuleHandleA
PulseEvent
MoveFileA
MoveFileExA
GetDateFormatA
GetTimeFormatA
MultiByteToWideChar
GetLocaleInfoA
GetCurrentProcessId
SwitchToThread
SetLastError
FindNextFileA
UnmapViewOfFile
CreateSemaphoreA
ReleaseSemaphore
CreateFileMappingA
MapViewOfFileEx
SetFilePointerEx
SetWaitableTimer
CreateWaitableTimerA
GetFileAttributesExA
GetQueuedCompletionStatus
GetShortPathNameA
ReadDirectoryChangesW
WideCharToMultiByte
GetNumberFormatA
FindFirstVolumeW
FindNextVolumeW
FindVolumeClose
GetDiskFreeSpaceA
QueryDosDeviceW
GetCompressedFileSizeA
GetCommModemStatus
SetSystemTime
GetCommState
SetCommState
GetVersionExA
FormatMessageW
MapViewOfFile
FreeResource
LoadLibraryExA
LoadResource
LockResource
FindResourceA
GetComputerNameExW
lstrlenA
BackupRead
BackupSeek
TerminateProcess
OpenProcess
SetEvent
GetModuleHandleW
LoadLibraryW
GetLogicalProcessorInformation
GlobalMemoryStatusEx
SizeofResource
GetFileAttributesW
QueryPerformanceCounter
QueryPerformanceFrequency
GetThreadTimes
lstrlenW
lstrcmpiA
lstrcpynA
IsDBCSLeadByte
GetComputerNameA
lstrcpyA
GetEnvironmentVariableA
GetACP
GlobalFree
GlobalUnlock
DeleteFileW
GetTempFileNameW
GetTempFileNameA
GetFileAttributesExW
SetFileAttributesW
GetFullPathNameW
GlobalLock
GlobalAlloc
CreateDirectoryW
ResetEvent
GetVersion
GetFileTime
FindFirstFileA
FindClose
FileTimeToLocalFileTime
CreateFileA
GetSystemInfo
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
GetStringTypeW
WaitForSingleObjectEx
GetNativeSystemInfo
EncodePointer
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
OutputDebugStringW
GetUserDefaultLCID
FreeLibraryAndExitThread
LoadLibraryExW
InterlockedPushEntrySList
RtlPcToFileHeader
RtlUnwindEx
ResumeThread
GetModuleHandleExW
GetDriveTypeW
GetFileType
ExitProcess
GetModuleFileNameA
GetStdHandle
GetCommandLineA
GetCommandLineW
GetConsoleMode
ReadConsoleW
GetConsoleCP
GetDateFormatW
GetTimeFormatW
IsValidLocale
EnumSystemLocalesW
SetStdHandle
FlushFileBuffers
GetCurrentDirectoryW
FindFirstFileExA
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
WriteConsoleW
TryEnterCriticalSection

user32

UnregisterClassA
MessageBoxA
GetSystemMetrics
wsprintfA
SendMessageA
DefWindowProcA
GetWindowLongPtrA
RegisterClassA
PostMessageA
DispatchMessageA
TranslateMessage
PostQuitMessage
PeekMessageA
DestroyWindow
SetWindowLongPtrA
CreateWindowExA
MsgWaitForMultipleObjects
IsWindow
RegisterWindowMessageA
wvsprintfA
MessageBeep

advapi32

GetAce
LsaSetInformationPolicy
LsaQueryInformationPolicy
LsaFreeMemory
LsaNtStatusToWinError
LsaOpenPolicy
LsaClose
EqualSid
DeleteAce
AllocateAndInitializeSid
AddAce
AddAccessAllowedAce
ConvertStringSidToSidA
FreeSid
CreateProcessWithLogonW
QueryServiceConfig2A
DeleteService
ChangeServiceConfig2A
RegConnectRegistryW
RegQueryValueExW
RegOpenKeyExW
RegDeleteKeyExA
RegConnectRegistryA
QueryServiceConfigA
EnumServicesStatusA
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
IsTextUnicode
RegNotifyChangeKeyValue
StartServiceA
StartServiceCtrlDispatcherA
SetServiceStatus
RegisterServiceCtrlHandlerA
QueryServiceStatus
OpenServiceA
OpenSCManagerA
CreateServiceA
ControlService
CloseServiceHandle
InitiateSystemShutdownA
RegFlushKey
LookupPrivilegeValueA
LookupAccountSidA
GetEventLogInformation
ReportEventA
ReadEventLogA
RegisterEventSourceA
OpenEventLogA
GetOldestEventLogRecord
GetNumberOfEventLogRecords
NotifyChangeEventLog
DeregisterEventSource
CloseEventLog
BackupEventLogA
ClearEventLogA
DuplicateTokenEx
AdjustTokenPrivileges
OpenProcessToken
CreateProcessAsUserW
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegCloseKey
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetAclInformation
GetLengthSid
InitializeAcl
IsValidSid
LookupAccountNameA
SetEntriesInAclA
SetNamedSecurityInfoA
GetNamedSecurityInfoA
ReportEventW
CryptAcquireContextA
CryptGetUserKey
CryptDestroyKey
CryptGetKeyParam
CryptGetProvParam
CryptImportKey
RegisterEventSourceW

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListA

ole32

CoInitializeEx
CoInitializeSecurity
CoCreateGuid
CoInitialize
CoSetProxyBlanket
CoTaskMemFree
CoCreateInstance
CoUninitialize

oleaut32

SafeArrayGetDim
VariantClear
VariantInit
VariantTimeToSystemTime
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElement
SysAllocString
VariantChangeType
SysFreeString

crypt32

CryptMsgClose
CryptMsgGetParam
CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext
CertNameToStrW
CertGetNameStringA
CertGetNameStringW
CryptQueryObject
CryptDecodeObject

wintrust

CryptCATAdminReleaseCatalogContext
WinVerifyTrust
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
CryptCATAdminAcquireContext
CryptCATAdminReleaseContext
CryptCATAdminEnumCatalogFromHash
CryptCATAdminCalcHashFromFileHandle
CryptCATCatalogInfoFromContext

setupapi

SetupDiGetClassDevsA
SetupDiGetDeviceInterfaceDetailA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces

mpr

WNetGetLastErrorA

dhcpcsvc

DhcpRequestParams
DhcpCApiCleanup
DhcpCApiInitialize

Exports

Exports

IPWorksSNMP_CertMgr_CheckIndex
IPWorksSNMP_CertMgr_Create
IPWorksSNMP_CertMgr_Destroy
IPWorksSNMP_CertMgr_Do
IPWorksSNMP_CertMgr_Get
IPWorksSNMP_CertMgr_GetEventError
IPWorksSNMP_CertMgr_GetEventErrorCode
IPWorksSNMP_CertMgr_GetLastError
IPWorksSNMP_CertMgr_GetLastErrorCode
IPWorksSNMP_CertMgr_Set
IPWorksSNMP_CertMgr_SetEventErrorAndCode
IPWorksSNMP_CertMgr_SetLastErrorAndCode
IPWorksSNMP_CertMgr_StaticDestroy
IPWorksSNMP_CertMgr_StaticInit
IPWorksSNMP_EvtStr
IPWorksSNMP_MibBrowser_CheckIndex
IPWorksSNMP_MibBrowser_Create
IPWorksSNMP_MibBrowser_Destroy
IPWorksSNMP_MibBrowser_Do
IPWorksSNMP_MibBrowser_Get
IPWorksSNMP_MibBrowser_GetEventError
IPWorksSNMP_MibBrowser_GetEventErrorCode
IPWorksSNMP_MibBrowser_GetLastError
IPWorksSNMP_MibBrowser_GetLastErrorCode
IPWorksSNMP_MibBrowser_Set
IPWorksSNMP_MibBrowser_SetEventErrorAndCode
IPWorksSNMP_MibBrowser_SetLastErrorAndCode
IPWorksSNMP_MibBrowser_StaticDestroy
IPWorksSNMP_MibBrowser_StaticInit
IPWorksSNMP_SNMPAgent_CheckIndex
IPWorksSNMP_SNMPAgent_Create
IPWorksSNMP_SNMPAgent_Destroy
IPWorksSNMP_SNMPAgent_Do
IPWorksSNMP_SNMPAgent_Get
IPWorksSNMP_SNMPAgent_GetEventError
IPWorksSNMP_SNMPAgent_GetEventErrorCode
IPWorksSNMP_SNMPAgent_GetLastError
IPWorksSNMP_SNMPAgent_GetLastErrorCode
IPWorksSNMP_SNMPAgent_Set
IPWorksSNMP_SNMPAgent_SetEventErrorAndCode
IPWorksSNMP_SNMPAgent_SetLastErrorAndCode
IPWorksSNMP_SNMPAgent_StaticDestroy
IPWorksSNMP_SNMPAgent_StaticInit
IPWorksSNMP_SNMPMgr_CheckIndex
IPWorksSNMP_SNMPMgr_Create
IPWorksSNMP_SNMPMgr_Destroy
IPWorksSNMP_SNMPMgr_Do
IPWorksSNMP_SNMPMgr_Get
IPWorksSNMP_SNMPMgr_GetEventError
IPWorksSNMP_SNMPMgr_GetEventErrorCode
IPWorksSNMP_SNMPMgr_GetLastError
IPWorksSNMP_SNMPMgr_GetLastErrorCode
IPWorksSNMP_SNMPMgr_Set
IPWorksSNMP_SNMPMgr_SetEventErrorAndCode
IPWorksSNMP_SNMPMgr_SetLastErrorAndCode
IPWorksSNMP_SNMPMgr_StaticDestroy
IPWorksSNMP_SNMPMgr_StaticInit
IPWorksSNMP_SNMPTCPAgent_CheckIndex
IPWorksSNMP_SNMPTCPAgent_Create
IPWorksSNMP_SNMPTCPAgent_Destroy
IPWorksSNMP_SNMPTCPAgent_Do
IPWorksSNMP_SNMPTCPAgent_Get
IPWorksSNMP_SNMPTCPAgent_GetEventError
IPWorksSNMP_SNMPTCPAgent_GetEventErrorCode
IPWorksSNMP_SNMPTCPAgent_GetLastError
IPWorksSNMP_SNMPTCPAgent_GetLastErrorCode
IPWorksSNMP_SNMPTCPAgent_Set
IPWorksSNMP_SNMPTCPAgent_SetEventErrorAndCode
IPWorksSNMP_SNMPTCPAgent_SetLastErrorAndCode
IPWorksSNMP_SNMPTCPAgent_StaticDestroy
IPWorksSNMP_SNMPTCPAgent_StaticInit
IPWorksSNMP_SNMPTCPMgr_CheckIndex
IPWorksSNMP_SNMPTCPMgr_Create
IPWorksSNMP_SNMPTCPMgr_Destroy
IPWorksSNMP_SNMPTCPMgr_Do
IPWorksSNMP_SNMPTCPMgr_Get
IPWorksSNMP_SNMPTCPMgr_GetEventError
IPWorksSNMP_SNMPTCPMgr_GetEventErrorCode
IPWorksSNMP_SNMPTCPMgr_GetLastError
IPWorksSNMP_SNMPTCPMgr_GetLastErrorCode
IPWorksSNMP_SNMPTCPMgr_Set
IPWorksSNMP_SNMPTCPMgr_SetEventErrorAndCode
IPWorksSNMP_SNMPTCPMgr_SetLastErrorAndCode
IPWorksSNMP_SNMPTCPMgr_StaticDestroy
IPWorksSNMP_SNMPTCPMgr_StaticInit
IPWorksSNMP_SNMPTCPTrapMgr_CheckIndex
IPWorksSNMP_SNMPTCPTrapMgr_Create
IPWorksSNMP_SNMPTCPTrapMgr_Destroy
IPWorksSNMP_SNMPTCPTrapMgr_Do
IPWorksSNMP_SNMPTCPTrapMgr_Get
IPWorksSNMP_SNMPTCPTrapMgr_GetEventError
IPWorksSNMP_SNMPTCPTrapMgr_GetEventErrorCode
IPWorksSNMP_SNMPTCPTrapMgr_GetLastError
IPWorksSNMP_SNMPTCPTrapMgr_GetLastErrorCode
IPWorksSNMP_SNMPTCPTrapMgr_Set
IPWorksSNMP_SNMPTCPTrapMgr_SetEventErrorAndCode
IPWorksSNMP_SNMPTCPTrapMgr_SetLastErrorAndCode
IPWorksSNMP_SNMPTCPTrapMgr_StaticDestroy
IPWorksSNMP_SNMPTCPTrapMgr_StaticInit
IPWorksSNMP_SNMPTrapMgr_CheckIndex
IPWorksSNMP_SNMPTrapMgr_Create
IPWorksSNMP_SNMPTrapMgr_Destroy
IPWorksSNMP_SNMPTrapMgr_Do
IPWorksSNMP_SNMPTrapMgr_Get
IPWorksSNMP_SNMPTrapMgr_GetEventError
IPWorksSNMP_SNMPTrapMgr_GetEventErrorCode
IPWorksSNMP_SNMPTrapMgr_GetLastError
IPWorksSNMP_SNMPTrapMgr_GetLastErrorCode
IPWorksSNMP_SNMPTrapMgr_Set
IPWorksSNMP_SNMPTrapMgr_SetEventErrorAndCode
IPWorksSNMP_SNMPTrapMgr_SetLastErrorAndCode
IPWorksSNMP_SNMPTrapMgr_StaticDestroy
IPWorksSNMP_SNMPTrapMgr_StaticInit
IPWorks_Atom_CheckIndex
IPWorks_Atom_Create
IPWorks_Atom_Destroy
IPWorks_Atom_Do
IPWorks_Atom_Get
IPWorks_Atom_GetEventError
IPWorks_Atom_GetEventErrorCode
IPWorks_Atom_GetLastError
IPWorks_Atom_GetLastErrorCode
IPWorks_Atom_Set
IPWorks_Atom_SetEventErrorAndCode
IPWorks_Atom_SetLastErrorAndCode
IPWorks_Atom_StaticDestroy
IPWorks_Atom_StaticInit
IPWorks_CalDAV_CheckIndex
IPWorks_CalDAV_Create
IPWorks_CalDAV_Destroy
IPWorks_CalDAV_Do
IPWorks_CalDAV_Get
IPWorks_CalDAV_GetEventError
IPWorks_CalDAV_GetEventErrorCode
IPWorks_CalDAV_GetLastError
IPWorks_CalDAV_GetLastErrorCode
IPWorks_CalDAV_Set
IPWorks_CalDAV_SetEventErrorAndCode
IPWorks_CalDAV_SetLastErrorAndCode
IPWorks_CalDAV_StaticDestroy
IPWorks_CalDAV_StaticInit
IPWorks_CertMgr_CheckIndex
IPWorks_CertMgr_Create
IPWorks_CertMgr_Destroy
IPWorks_CertMgr_Do
IPWorks_CertMgr_Get
IPWorks_CertMgr_GetEventError
IPWorks_CertMgr_GetEventErrorCode
IPWorks_CertMgr_GetLastError
IPWorks_CertMgr_GetLastErrorCode
IPWorks_CertMgr_Set
IPWorks_CertMgr_SetEventErrorAndCode
IPWorks_CertMgr_SetLastErrorAndCode
IPWorks_CertMgr_StaticDestroy
IPWorks_CertMgr_StaticInit
IPWorks_DNS_CheckIndex
IPWorks_DNS_Create
IPWorks_DNS_Destroy
IPWorks_DNS_Do
IPWorks_DNS_Get
IPWorks_DNS_GetEventError
IPWorks_DNS_GetEventErrorCode
IPWorks_DNS_GetLastError
IPWorks_DNS_GetLastErrorCode
IPWorks_DNS_Set
IPWorks_DNS_SetEventErrorAndCode
IPWorks_DNS_SetLastErrorAndCode
IPWorks_DNS_StaticDestroy
IPWorks_DNS_StaticInit
IPWorks_EvtStr
IPWorks_FTP_CheckIndex
IPWorks_FTP_Create
IPWorks_FTP_Destroy
IPWorks_FTP_Do
IPWorks_FTP_Get
IPWorks_FTP_GetEventError
IPWorks_FTP_GetEventErrorCode
IPWorks_FTP_GetLastError
IPWorks_FTP_GetLastErrorCode
IPWorks_FTP_Set
IPWorks_FTP_SetEventErrorAndCode
IPWorks_FTP_SetLastErrorAndCode
IPWorks_FTP_StaticDestroy
IPWorks_FTP_StaticInit
IPWorks_FileMailer_CheckIndex
IPWorks_FileMailer_Create
IPWorks_FileMailer_Destroy
IPWorks_FileMailer_Do
IPWorks_FileMailer_Get
IPWorks_FileMailer_GetEventError
IPWorks_FileMailer_GetEventErrorCode
IPWorks_FileMailer_GetLastError
IPWorks_FileMailer_GetLastErrorCode
IPWorks_FileMailer_Set
IPWorks_FileMailer_SetEventErrorAndCode
IPWorks_FileMailer_SetLastErrorAndCode
IPWorks_FileMailer_StaticDestroy
IPWorks_FileMailer_StaticInit
IPWorks_HTMLMailer_CheckIndex
IPWorks_HTMLMailer_Create
IPWorks_HTMLMailer_Destroy
IPWorks_HTMLMailer_Do
IPWorks_HTMLMailer_Get
IPWorks_HTMLMailer_GetEventError
IPWorks_HTMLMailer_GetEventErrorCode
IPWorks_HTMLMailer_GetLastError
IPWorks_HTMLMailer_GetLastErrorCode
IPWorks_HTMLMailer_Set
IPWorks_HTMLMailer_SetEventErrorAndCode
IPWorks_HTMLMailer_SetLastErrorAndCode
IPWorks_HTMLMailer_StaticDestroy
IPWorks_HTMLMailer_StaticInit
IPWorks_HTTP_CheckIndex
IPWorks_HTTP_Create
IPWorks_HTTP_Destroy
IPWorks_HTTP_Do
IPWorks_HTTP_Get
IPWorks_HTTP_GetEventError
IPWorks_HTTP_GetEventErrorCode
IPWorks_HTTP_GetLastError
IPWorks_HTTP_GetLastErrorCode
IPWorks_HTTP_Set
IPWorks_HTTP_SetEventErrorAndCode
IPWorks_HTTP_SetLastErrorAndCode
IPWorks_HTTP_StaticDestroy
IPWorks_HTTP_StaticInit
IPWorks_ICMPPort_CheckIndex
IPWorks_ICMPPort_Create
IPWorks_ICMPPort_Destroy
IPWorks_ICMPPort_Do
IPWorks_ICMPPort_Get
IPWorks_ICMPPort_GetEventError
IPWorks_ICMPPort_GetEventErrorCode
IPWorks_ICMPPort_GetLastError
IPWorks_ICMPPort_GetLastErrorCode
IPWorks_ICMPPort_Set
IPWorks_ICMPPort_SetEventErrorAndCode
IPWorks_ICMPPort_SetLastErrorAndCode
IPWorks_ICMPPort_StaticDestroy
IPWorks_ICMPPort_StaticInit
IPWorks_IMAP_CheckIndex
IPWorks_IMAP_Create
IPWorks_IMAP_Destroy
IPWorks_IMAP_Do
IPWorks_IMAP_Get
IPWorks_IMAP_GetEventError
IPWorks_IMAP_GetEventErrorCode
IPWorks_IMAP_GetLastError
IPWorks_IMAP_GetLastErrorCode
IPWorks_IMAP_Set
IPWorks_IMAP_SetEventErrorAndCode
IPWorks_IMAP_SetLastErrorAndCode
IPWorks_IMAP_StaticDestroy
IPWorks_IMAP_StaticInit
IPWorks_IPDaemon_CheckIndex
IPWorks_IPDaemon_Create
IPWorks_IPDaemon_Destroy
IPWorks_IPDaemon_Do
IPWorks_IPDaemon_Get
IPWorks_IPDaemon_GetEventError
IPWorks_IPDaemon_GetEventErrorCode
IPWorks_IPDaemon_GetLastError
IPWorks_IPDaemon_GetLastErrorCode
IPWorks_IPDaemon_Set
IPWorks_IPDaemon_SetEventErrorAndCode
IPWorks_IPDaemon_SetLastErrorAndCode
IPWorks_IPDaemon_StaticDestroy
IPWorks_IPDaemon_StaticInit
IPWorks_IPInfo_CheckIndex
IPWorks_IPInfo_Create
IPWorks_IPInfo_Destroy
IPWorks_IPInfo_Do
IPWorks_IPInfo_Get
IPWorks_IPInfo_GetEventError
IPWorks_IPInfo_GetEventErrorCode
IPWorks_IPInfo_GetLastError
IPWorks_IPInfo_GetLastErrorCode
IPWorks_IPInfo_Set
IPWorks_IPInfo_SetEventErrorAndCode
IPWorks_IPInfo_SetLastErrorAndCode
IPWorks_IPInfo_StaticDestroy
IPWorks_IPInfo_StaticInit
IPWorks_IPMonitor_CheckIndex
IPWorks_IPMonitor_Create
IPWorks_IPMonitor_Destroy
IPWorks_IPMonitor_Do
IPWorks_IPMonitor_Get
IPWorks_IPMonitor_GetEventError
IPWorks_IPMonitor_GetEventErrorCode
IPWorks_IPMonitor_GetLastError
IPWorks_IPMonitor_GetLastErrorCode
IPWorks_IPMonitor_Set
IPWorks_IPMonitor_SetEventErrorAndCode
IPWorks_IPMonitor_SetLastErrorAndCode
IPWorks_IPMonitor_StaticDestroy
IPWorks_IPMonitor_StaticInit
IPWorks_IPPort_CheckIndex
IPWorks_IPPort_Create
IPWorks_IPPort_Destroy
IPWorks_IPPort_Do
IPWorks_IPPort_Get
IPWorks_IPPort_GetEventError
IPWorks_IPPort_GetEventErrorCode
IPWorks_IPPort_GetLastError
IPWorks_IPPort_GetLastErrorCode
IPWorks_IPPort_Set
IPWorks_IPPort_SetEventErrorAndCode
IPWorks_IPPort_SetLastErrorAndCode
IPWorks_IPPort_StaticDestroy
IPWorks_IPPort_StaticInit
IPWorks_JSON_CheckIndex
IPWorks_JSON_Create
IPWorks_JSON_Destroy
IPWorks_JSON_Do
IPWorks_JSON_Get
IPWorks_JSON_GetEventError
IPWorks_JSON_GetEventErrorCode
IPWorks_JSON_GetLastError
IPWorks_JSON_GetLastErrorCode
IPWorks_JSON_Set
IPWorks_JSON_SetEventErrorAndCode
IPWorks_JSON_SetLastErrorAndCode
IPWorks_JSON_StaticDestroy
IPWorks_JSON_StaticInit
IPWorks_LDAP_CheckIndex
IPWorks_LDAP_Create
IPWorks_LDAP_Destroy
IPWorks_LDAP_Do
IPWorks_LDAP_Get
IPWorks_LDAP_GetEventError
IPWorks_LDAP_GetEventErrorCode
IPWorks_LDAP_GetLastError
IPWorks_LDAP_GetLastErrorCode
IPWorks_LDAP_Set
IPWorks_LDAP_SetEventErrorAndCode
IPWorks_LDAP_SetLastErrorAndCode
IPWorks_LDAP_StaticDestroy
IPWorks_LDAP_StaticInit
IPWorks_MCast_CheckIndex
IPWorks_MCast_Create
IPWorks_MCast_Destroy
IPWorks_MCast_Do
IPWorks_MCast_Get
IPWorks_MCast_GetEventError
IPWorks_MCast_GetEventErrorCode
IPWorks_MCast_GetLastError
IPWorks_MCast_GetLastErrorCode
IPWorks_MCast_Set
IPWorks_MCast_SetEventErrorAndCode
IPWorks_MCast_SetLastErrorAndCode
IPWorks_MCast_StaticDestroy
IPWorks_MCast_StaticInit
IPWorks_MIME_CheckIndex
IPWorks_MIME_Create
IPWorks_MIME_Destroy
IPWorks_MIME_Do
IPWorks_MIME_Get
IPWorks_MIME_GetEventError
IPWorks_MIME_GetEventErrorCode
IPWorks_MIME_GetLastError
IPWorks_MIME_GetLastErrorCode
IPWorks_MIME_Set
IPWorks_MIME_SetEventErrorAndCode
IPWorks_MIME_SetLastErrorAndCode
IPWorks_MIME_StaticDestroy
IPWorks_MIME_StaticInit
IPWorks_MX_CheckIndex
IPWorks_MX_Create
IPWorks_MX_Destroy
IPWorks_MX_Do
IPWorks_MX_Get
IPWorks_MX_GetEventError
IPWorks_MX_GetEventErrorCode
IPWorks_MX_GetLastError
IPWorks_MX_GetLastErrorCode
IPWorks_MX_Set
IPWorks_MX_SetEventErrorAndCode
IPWorks_MX_SetLastErrorAndCode
IPWorks_MX_StaticDestroy
IPWorks_MX_StaticInit
IPWorks_NNTP_CheckIndex
IPWorks_NNTP_Create
IPWorks_NNTP_Destroy
IPWorks_NNTP_Do
IPWorks_NNTP_Get
IPWorks_NNTP_GetEventError
IPWorks_NNTP_GetEventErrorCode
IPWorks_NNTP_GetLastError
IPWorks_NNTP_GetLastErrorCode
IPWorks_NNTP_Set
IPWorks_NNTP_SetEventErrorAndCode
IPWorks_NNTP_SetLastErrorAndCode
IPWorks_NNTP_StaticDestroy
IPWorks_NNTP_StaticInit
IPWorks_NetClock_CheckIndex
IPWorks_NetClock_Create
IPWorks_NetClock_Destroy
IPWorks_NetClock_Do
IPWorks_NetClock_Get
IPWorks_NetClock_GetEventError
IPWorks_NetClock_GetEventErrorCode
IPWorks_NetClock_GetLastError
IPWorks_NetClock_GetLastErrorCode
IPWorks_NetClock_Set
IPWorks_NetClock_SetEventErrorAndCode
IPWorks_NetClock_SetLastErrorAndCode
IPWorks_NetClock_StaticDestroy
IPWorks_NetClock_StaticInit
IPWorks_NetCode_CheckIndex
IPWorks_NetCode_Create
IPWorks_NetCode_Destroy
IPWorks_NetCode_Do
IPWorks_NetCode_Get
IPWorks_NetCode_GetEventError
IPWorks_NetCode_GetEventErrorCode
IPWorks_NetCode_GetLastError
IPWorks_NetCode_GetLastErrorCode
IPWorks_NetCode_Set
IPWorks_NetCode_SetEventErrorAndCode
IPWorks_NetCode_SetLastErrorAndCode
IPWorks_NetCode_StaticDestroy
IPWorks_NetCode_StaticInit
IPWorks_NetDial_CheckIndex
IPWorks_NetDial_Create
IPWorks_NetDial_Destroy
IPWorks_NetDial_Do
IPWorks_NetDial_Get
IPWorks_NetDial_GetEventError
IPWorks_NetDial_GetEventErrorCode
IPWorks_NetDial_GetLastError
IPWorks_NetDial_GetLastErrorCode
IPWorks_NetDial_Set
IPWorks_NetDial_SetEventErrorAndCode
IPWorks_NetDial_SetLastErrorAndCode
IPWorks_NetDial_StaticDestroy
IPWorks_NetDial_StaticInit
IPWorks_OAuth_CheckIndex
IPWorks_OAuth_Create
IPWorks_OAuth_Destroy
IPWorks_OAuth_Do
IPWorks_OAuth_Get
IPWorks_OAuth_GetEventError
IPWorks_OAuth_GetEventErrorCode
IPWorks_OAuth_GetLastError
IPWorks_OAuth_GetLastErrorCode
IPWorks_OAuth_Set
IPWorks_OAuth_SetEventErrorAndCode
IPWorks_OAuth_SetLastErrorAndCode
IPWorks_OAuth_StaticDestroy
IPWorks_OAuth_StaticInit
IPWorks_OData_CheckIndex
IPWorks_OData_Create
IPWorks_OData_Destroy
IPWorks_OData_Do
IPWorks_OData_Get
IPWorks_OData_GetEventError
IPWorks_OData_GetEventErrorCode
IPWorks_OData_GetLastError
IPWorks_OData_GetLastErrorCode
IPWorks_OData_Set
IPWorks_OData_SetEventErrorAndCode
IPWorks_OData_SetLastErrorAndCode
IPWorks_OData_StaticDestroy
IPWorks_OData_StaticInit
IPWorks_POP_CheckIndex
IPWorks_POP_Create
IPWorks_POP_Destroy
IPWorks_POP_Do
IPWorks_POP_Get
IPWorks_POP_GetEventError
IPWorks_POP_GetEventErrorCode
IPWorks_POP_GetLastError
IPWorks_POP_GetLastErrorCode
IPWorks_POP_Set
IPWorks_POP_SetEventErrorAndCode
IPWorks_POP_SetLastErrorAndCode
IPWorks_POP_StaticDestroy
IPWorks_POP_StaticInit
IPWorks_Ping_CheckIndex
IPWorks_Ping_Create
IPWorks_Ping_Destroy
IPWorks_Ping_Do
IPWorks_Ping_Get
IPWorks_Ping_GetEventError
IPWorks_Ping_GetEventErrorCode
IPWorks_Ping_GetLastError
IPWorks_Ping_GetLastErrorCode
IPWorks_Ping_Set
IPWorks_Ping_SetEventErrorAndCode
IPWorks_Ping_SetLastErrorAndCode
IPWorks_Ping_StaticDestroy
IPWorks_Ping_StaticInit
IPWorks_RCP_CheckIndex
IPWorks_RCP_Create
IPWorks_RCP_Destroy
IPWorks_RCP_Do
IPWorks_RCP_Get
IPWorks_RCP_GetEventError
IPWorks_RCP_GetEventErrorCode
IPWorks_RCP_GetLastError

Sections

.text
Size: 8.1MB - Virtual size: 8.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 96KB - Virtual size: 608KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 268KB - Virtual size: 268KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4.3MB - Virtual size: 4.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8cf79ffe5d2e3d0b4bc671d915662670

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

iphlpapi

netapi32

pdh

rpcrt4

version

winmm

ws2_32

chartdir51

kernel32

user32

advapi32

shell32

ole32

oleaut32

crypt32

wintrust

setupapi

mpr

dhcpcsvc

Exports

Exports

Sections

.text Size: 8.1MB - Virtual size: 8.1MB

.rdata Size: 1.6MB - Virtual size: 1.6MB

.data Size: 96KB - Virtual size: 608KB

.pdata Size: 268KB - Virtual size: 268KB

.gfids Size: 2KB - Virtual size: 1KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 4.3MB - Virtual size: 4.3MB

.reloc Size: 35KB - Virtual size: 34KB

.text
Size: 8.1MB - Virtual size: 8.1MB

.rdata
Size: 1.6MB - Virtual size: 1.6MB

.data
Size: 96KB - Virtual size: 608KB

.pdata
Size: 268KB - Virtual size: 268KB

.gfids
Size: 2KB - Virtual size: 1KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 4.3MB - Virtual size: 4.3MB

.reloc
Size: 35KB - Virtual size: 34KB