VirusShare-003faff5ec6bf135db1d47ac1ebbe747

Sharing

Copy URL Twitter E-mail

General

Target

VirusShare-003faff5ec6bf135db1d47ac1ebbe747
Size

416KB
MD5

003faff5ec6bf135db1d47ac1ebbe747
SHA1

64a9d9726e82bd84ee14a835013112901036841e
SHA256

5d5e2e79a8a73ac06e2519a26c2f60406ad90db2b3c68f4d69c291677109d41b
SHA512

31310d1d1e0cb9d803ca9d358f5004f44574804667c6239be12ebc5a7950c0841a56fdaf4dc7311dd6207ec0c5442bdef855ff52b894a7d4cdde3d41d2c412d2
SSDEEP

12288:uaVhCcHHfCBN/xa4fPNtAXmJffKeVRZVQo6QtumE/m:Ek4TAXmJffKeVRZVQwom

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
VirusShare-003faff5ec6bf135db1d47ac1ebbe747

Files

VirusShare-003faff5ec6bf135db1d47ac1ebbe747
.dll windows:4 windows x86 arch:x86

78a0a5580b515d6f60e61d97b2ac8ddb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wininet

CommitUrlCacheEntryA
CreateUrlCacheEntryA
UnlockUrlCacheEntryFile
RetrieveUrlCacheEntryFileA

rpcrt4

NdrPointerMarshall
NdrConvert
RpcRaiseException
RpcServerUnregisterIf
RpcMgmtStopServerListening
RpcServerListen
RpcServerRegisterIf
RpcServerUseProtseqEpA
NdrPointerFree
NdrConformantArrayUnmarshall
I_RpcGetBuffer
NdrPointerBufferSize
NdrServerInitializeNew

kernel32

TerminateProcess
GetCurrentDirectoryA
GetFullPathNameA
FindFirstFileA
GetDriveTypeA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
GetLocaleInfoA
CloseHandle
WaitForSingleObject
Sleep
OpenMutexA
CreateMutexA
GetCurrentProcessId
ReleaseSemaphore
OpenSemaphoreA
ReleaseMutex
SetEvent
CreateSemaphoreA
ResetEvent
CreateEventA
GetCurrentThreadId
GetLastError
VirtualFree
VirtualAlloc
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetFileSize
CreateFileA
LoadLibraryA
SetStdHandle
GetCPInfo
GetOEMCP
GetACP
IsBadCodePtr
SetUnhandledExceptionFilter
InitializeCriticalSection
GetStringTypeW
GetStringTypeA
VirtualQuery
GetSystemInfo
VirtualProtect
SetFilePointer
ReadFile
LCMapStringW
MultiByteToWideChar
LCMapStringA
IsBadWritePtr
HeapCreate
HeapDestroy
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
HeapSize
HeapReAlloc
GetModuleFileNameA
GetTickCount
RtlUnwind
GetSystemTimeAsFileTime
IsBadReadPtr
ExitProcess
GetProcAddress
GetModuleHandleA
GetCurrentProcess
EnterCriticalSection
LeaveCriticalSection
ExitThread
TlsSetValue
TlsGetValue
ResumeThread
CreateThread
GetCommandLineA
GetVersionExA
HeapAlloc
HeapFree
GetTimeFormatA
GetDateFormatA
DeleteCriticalSection
TlsFree
SetLastError
TlsAlloc
RaiseException
WriteFile
FlushFileBuffers
WideCharToMultiByte
GetTimeZoneInformation
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
QueryPerformanceCounter

user32

PostMessageA
PeekMessageA

wsock32

htons
ioctlsocket
WSAGetLastError
WSACleanup
WSAStartup
closesocket
getsockname
connect
recv
send
inet_ntoa
setsockopt
socket
listen
bind
htonl
accept
ntohs
ntohl
inet_addr
__WSAFDIsSet
select
gethostname
gethostbyname

Exports

Exports

SDICoreGetClientStats
SDICoreGetUpdatedStatsFlag
SDICoreGetVersion
SDICoreGetWorkerThreadID
SDICoreInit
SDICoreReconnectToSx
SDICoreReinit
SDICoreResetClientStats
SDICoreSetAuthPassword
SDICoreSetAuthUsername
SDICoreSetAuthenticationTimeout
SDICoreSetHTTPDBPath
SDICoreSetHTTPDBSize
SDICoreSetHTTPListeningPort
SDICoreSetHWND
SDICoreSetImageQuality
SDICoreSetImmediateConnectToSx
SDICoreSetMaxClientConnectionPeriod
SDICoreSetMaxClientConnectionsPerPeriod
SDICoreSetMaxConnectionRetries
SDICoreSetSxIP
SDICoreSetSxName
SDICoreSetSxPort
SDICoreSetTunnelTimeout
SDICoreStartHTTPSThread
SDICoreStartWorkerThread
SDICoreStopHTTPSThread
SDICoreStopWorkerThread
SDICoreUninit

Sections

.text
Size: 244KB - Virtual size: 240KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

78a0a5580b515d6f60e61d97b2ac8ddb

Headers

File Characteristics

Imports

wininet

rpcrt4

kernel32

user32

wsock32

Exports

Exports

Sections

.text Size: 244KB - Virtual size: 240KB

.rdata Size: 52KB - Virtual size: 49KB

.data Size: 12KB - Virtual size: 19KB

.reloc Size: 16KB - Virtual size: 14KB

.text
Size: 244KB - Virtual size: 240KB

.rdata
Size: 52KB - Virtual size: 49KB

.data
Size: 12KB - Virtual size: 19KB

.reloc
Size: 16KB - Virtual size: 14KB