7ed1edbe6e32fd4705f0ebf1dfcb3079

Sharing

Copy URL Twitter E-mail

General

Target

7ed1edbe6e32fd4705f0ebf1dfcb3079
Size

230KB
MD5

7ed1edbe6e32fd4705f0ebf1dfcb3079
SHA1

2a071672eeafec3126f6737e9c4e2bc34d688de4
SHA256

b699c480766895b032bfef5d590c54dce624f9a612bc01b96aaf47081104e236
SHA512

548e2db38afdfbc0d95953649043c9cdbdc5b3e070ab7ac7d7b1306eb4ccf453e94a688099d46cd92fe7e1132c8ac660490282822cf481011cc09e9547bf26fd
SSDEEP

3072:gFclliH515wADWf0UxmUgjUbWEuwtVVnjHS2njXFYxzTuNGUHYdCwKrdY57MUhBo:gFclw51Xom2bWuHS2jVcV5IwKrdY57l

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7ed1edbe6e32fd4705f0ebf1dfcb3079

Files

7ed1edbe6e32fd4705f0ebf1dfcb3079
.dll windows:5 windows x86 arch:x86

5cbad31da21856e012db81b010b80a1d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

rasapi32.pdb

Imports

msvcrt

wcsncmp
wcslen
wcscpy
strncpy
_wcslwr
_ltoa
qsort
wcsstr
_wcsnicmp
_wtol
_itow
_except_handler3
_snwprintf
_ultow
atol
_strlwr
strncat
_strnicmp
_wcsicmp
strchr
_mbscspn
strrchr
_stricmp
wcscat
_ltow
wcsncpy
wcsncat
wcstoul
strstr
_adjust_fdiv
malloc
_initterm
free
memmove

ntdll

RtlOpenCurrentUser
NtClose
RtlFreeUnicodeString
RtlNtStatusToDosError
RtlAnsiStringToUnicodeString
RtlInitUnicodeString
RtlInitAnsiString
NtQueryValueKey
NtOpenKey
NtSetValueKey
DbgPrint

advapi32

RegConnectRegistryW
QueryServiceStatus
FreeSid
AllocateAndInitializeSid
CheckTokenMembership
RegOpenKeyW
RegEnumKeyExW
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
OpenSCManagerW
OpenServiceW
CloseServiceHandle
ControlService
OpenProcessToken
GetTokenInformation
RegEnumKeyW
RegDeleteKeyW
RegQueryInfoKeyW
RegEnumValueW
RegDeleteValueW
RegOpenKeyExW
RegCreateKeyExW
RegQueryValueExW
RegCloseKey
RegSetValueExW
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
GetSidSubAuthority
OpenThreadToken
GetSidLengthRequired
InitializeSid
SetSecurityDescriptorDacl

kernel32

InterlockedDecrement
InterlockedIncrement
GetVersionExW
CreateDirectoryW
ExpandEnvironmentStringsW
GetSystemWindowsDirectoryW
GetCurrentThread
OpenMutexA
CreateMutexA
ReleaseMutex
CreateFileW
GetFullPathNameW
GlobalSize
HeapAlloc
HeapReAlloc
HeapFree
FreeLibrary
GetProcAddress
GetLastError
LoadLibraryW
GlobalAlloc
GlobalFree
lstrcpynW
FormatMessageW
FormatMessageA
LocalFree
LocalAlloc
LeaveCriticalSection
EnterCriticalSection
lstrcmpiW
lstrlenW
PostQueuedCompletionStatus
GetQueuedCompletionStatus
SetEvent
CloseHandle
CreateThread
WaitForSingleObject
CreateIoCompletionPort
CreateEventW
DelayLoadFailureHook
InitializeCriticalSection
DisableThreadLibraryCalls
GetCurrentProcess
lstrcmpW
ResetEvent
lstrcpyA
Sleep
GetFileAttributesW
lstrcpynA
GlobalReAlloc
lstrlenA
CreateFileA
MoveFileA
DeleteFileA
ReadFile
WriteFile
lstrcatA
WideCharToMultiByte
MultiByteToWideChar
GetModuleHandleW
lstrcpyW
GetSystemDirectoryW
CompareStringW
GetCommandLineW
FindClose
FindNextFileW
FindFirstFileW
InterlockedCompareExchange
LoadLibraryA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
OpenEventA
lstrcatW
DeleteCriticalSection
GetCommandLineA
InterlockedExchange
SetEndOfFile
SetFilePointer
ExpandEnvironmentStringsA
WaitForMultipleObjects
CreateEventA
lstrcmpiA
lstrcmpA
IsDBCSLeadByte

rasman

RasRpcGetInstalledProtocols
RasRpcGetInstalledProtocolsEx
RasRpcSetUserPreferences
RasGetDeviceNameW
RasSendNotification
RasIsTrustedCustomDll
RasSetCommSettings
RasGetCustomScriptDll
RasRpcGetUserPreferences
RasGetUnicodeDeviceName
RasSetKey
RasGetKey
RasGetPortUserData
RasDoIke
DwRasGetHostByName
RasSetAddressDisable
RasSetPortUserData
RasPortDisconnect
RasmanUninitialize
RasRefreshKerbCreds
RasSendCreds

tapi32

lineGetTranslateCapsW
lineGetCountryW
lineTranslateAddressW

user32

CharNextW
CharPrevW
wsprintfW
SendMessageW
OemToCharBuffA
RegisterWindowMessageA
SendMessageA
SendNotifyMessageA
wsprintfA
CharNextA
IsCharAlphaNumericA
IsCharAlphaA
LoadStringA

rpcrt4

I_RpcExceptionFilter
UuidCreate

Exports

Exports

DDMGetPhonebookInfo
DwCloneEntry
DwDeleteSubEntry
DwEnumEntriesForAllUsers
DwEnumEntryDetails
DwRasRefreshKerbScCreds
DwRasUninitialize
RasAutoDialSharedConnection
RasAutodialAddressToNetwork
RasAutodialEntryToNetwork
RasClearConnectionStatistics
RasClearLinkStatistics
RasConnectionNotificationA
RasConnectionNotificationW
RasCreatePhonebookEntryA
RasCreatePhonebookEntryW
RasDeleteEntryA
RasDeleteEntryW
RasDeleteSubEntryA
RasDeleteSubEntryW
RasDialA
RasDialW
RasDialWow
RasEditPhonebookEntryA
RasEditPhonebookEntryW
RasEnumAutodialAddressesA
RasEnumAutodialAddressesW
RasEnumConnectionsA
RasEnumConnectionsW
RasEnumConnectionsWow
RasEnumDevicesA
RasEnumDevicesW
RasEnumEntriesA
RasEnumEntriesW
RasEnumEntriesWow
RasFreeEapUserIdentityA
RasFreeEapUserIdentityW
RasGetAutodialAddressA
RasGetAutodialAddressW
RasGetAutodialEnableA
RasGetAutodialEnableW
RasGetAutodialParamA
RasGetAutodialParamW
RasGetConnectResponse
RasGetConnectStatusA
RasGetConnectStatusW
RasGetConnectStatusWow
RasGetConnectionStatistics
RasGetCountryInfoA
RasGetCountryInfoW
RasGetCredentialsA
RasGetCredentialsW
RasGetCustomAuthDataA
RasGetCustomAuthDataW
RasGetEapUserDataA
RasGetEapUserDataW
RasGetEapUserIdentityA
RasGetEapUserIdentityW
RasGetEntryDialParamsA
RasGetEntryDialParamsW
RasGetEntryHrasconnA
RasGetEntryHrasconnW
RasGetEntryPropertiesA
RasGetEntryPropertiesW
RasGetErrorStringA
RasGetErrorStringW
RasGetErrorStringWow
RasGetHport
RasGetLinkStatistics
RasGetProjectionInfoA
RasGetProjectionInfoW
RasGetSubEntryHandleA
RasGetSubEntryHandleW
RasGetSubEntryPropertiesA
RasGetSubEntryPropertiesW
RasHangUpA
RasHangUpW
RasHangUpWow
RasInvokeEapUI
RasIsRouterConnection
RasIsSharedConnection
RasQueryRedialOnLinkFailure
RasQuerySharedAutoDial
RasQuerySharedConnection
RasRenameEntryA
RasRenameEntryW
RasScriptExecute
RasScriptGetEventCode
RasScriptGetIpAddress
RasScriptInit
RasScriptReceive
RasScriptSend
RasScriptTerm
RasSetAutodialAddressA
RasSetAutodialAddressW
RasSetAutodialEnableA
RasSetAutodialEnableW
RasSetAutodialParamA
RasSetAutodialParamW
RasSetCredentialsA
RasSetCredentialsW
RasSetCustomAuthDataA
RasSetCustomAuthDataW
RasSetEapUserDataA
RasSetEapUserDataW
RasSetEntryDialParamsA
RasSetEntryDialParamsW
RasSetEntryPropertiesA
RasSetEntryPropertiesW
RasSetOldPassword
RasSetSharedAutoDial
RasSetSubEntryPropertiesA
RasSetSubEntryPropertiesW
RasValidateEntryNameA
RasValidateEntryNameW
RasfileClose
RasfileDeleteLine
RasfileFindFirstLine
RasfileFindLastLine
RasfileFindMarkedLine
RasfileFindNextKeyLine
RasfileFindNextLine
RasfileFindPrevLine
RasfileFindSectionLine
RasfileGetKeyValueFields
RasfileGetLine
RasfileGetLineMark
RasfileGetLineText
RasfileGetLineType
RasfileGetSectionName
RasfileInsertLine
RasfileLoad
RasfileLoadInfo
RasfilePutKeyValueFields
RasfilePutLineMark
RasfilePutLineText
RasfilePutSectionName
RasfileWrite
SharedAccessResponseListToString
SharedAccessResponseStringToList
UnInitializeRAS

Sections

.text
Size: 214KB - Virtual size: 214KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 239KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

5cbad31da21856e012db81b010b80a1d

Headers

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

advapi32

kernel32

rasman

tapi32

user32

rpcrt4

Exports

Exports

Sections

.text Size: 214KB - Virtual size: 214KB

.data Size: 1024B - Virtual size: 3KB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 11KB - Virtual size: 239KB

.text
Size: 214KB - Virtual size: 214KB

.data
Size: 1024B - Virtual size: 3KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 11KB - Virtual size: 239KB