a23d8a844d5efc49b8a68bc9a48785ac

Sharing

Copy URL Twitter E-mail

General

Target

a23d8a844d5efc49b8a68bc9a48785ac
Size

210KB
MD5

a23d8a844d5efc49b8a68bc9a48785ac
SHA1

a219ab5df90264571896f4977d87ed9aa10ee9ce
SHA256

16f0c3d4cec03e2d398a5a32914a1c6be3c89180c7b981ffd13e3bc9344be5b8
SHA512

8dda5b2eb6f8a7a63f203389864322fb12dc2512c87211edaa7660a67d5eee620b19c5ba95ee4504e06bbe52b5e40ace50c11e99076c030ba24da4b13f1638e8
SSDEEP

3072:Wc8/USvFm8SmDeRsaTysnsipc3CTJ9LNuMdH6DT4FfvYig5uWXs8CbFZ68Z:s9jNCs83sCkUJFNzH6fIfApdc8Cxb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a23d8a844d5efc49b8a68bc9a48785ac

Files

a23d8a844d5efc49b8a68bc9a48785ac
.dll windows:4 windows x86 arch:x86

9334ee5f0c3bb62ce40ee3665eec1920

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

calloc
sprintf
srand
toupper
fwrite
fread
fclose
_iob
rand
_adjust_fdiv
malloc
_initterm
fopen
free
remove

kernel32

MultiByteToWideChar
GetLastError
DisableThreadLibraryCalls
WideCharToMultiByte
GetTickCount
GetComputerNameA

advapi32

GetUserNameA

core40

ord424
ord425

nlsrtl33

ord58
ord224
ord276
ord233
ord67
ord279
ord231
ord133
ord116
ord175
ord112
ord117
ord248
ord172

nl80

snlfncdir
nlstdgg
nlstdstp

ns80

nsrefuse
nsdisc
nsanswer
nsevwait
nsevreg
nsballoc
nsaccept
nslisten
nsgbltrm
nsbfree
nsgblini

nnfg80

nnfsn2a
nnfsdei

ncr80

sncrswntgad
ncrfub4
ncrfopaq

Exports

Exports

szrcctmn_GetMachName
szrcctqs_GetUniqueStr
szrcctun_GetUserName
szrclol_LocaletoNLSLANGA
szrclol_LocaletoNLSLANGW
szrclon_NLSLANGtoLocaleA
szrclon_NLSLANGtoLocaleW
szrclox_GetLocaleSuffixA
szrclox_GetLocaleSuffixW
zrcctas_AddCacheFile
zrcctbl_DBLogin
zrcctcc_CheckCommand
zrcctce_EngineConnect
zrcctcl_CommandLine
zrcctco_Connect
zrcctcr_Create
zrcctcs_SetCacheSize
zrcctcx_GetCookieDomain
zrcctdd_ShutdownDaemon
zrcctde_Destroy
zrcctdi_Disconnect
zrcctdl_SetDaemonLoad
zrcctdn_SecurityDone
zrcctdu_DaemonUpdate
zrcctec_EmptyCache
zrcctfd_DaemonDisconnect
zrcctgc_GetCommand
zrcctgf_GetFile
zrcctgg_GetOutputGeneral
zrcctgo_GetOutput
zrcctgr_GetRemoteFileName
zrcctid_InitDaemon
zrcctju_JobUpdate
zrcctke_KillEngine
zrcctke_KillJobEngine
zrcctkj_KillJob
zrcctll_ListenLoop
zrcctoj_OrderJob
zrcctps_PutSource
zrcctpw_ChgPassword
zrcctqa_QAdminLogin
zrcctqu_QueueUpdate
zrcctra_RunReportAsync
zrcctrj_RescheduleJob
zrcctrs_RunReportSync
zrcctsa_SetAuthId
zrcctsc_SlaveConnect
zrcctsd_SyncJobDone
zrcctse_SpawnEngine
zrcctsi_SlaveDisconnect
zrcctsl_SysLogin
zrcctst_RunStatus
zrcctud_JobDestUpdate
zrcctver
zrcencb_EncodeBase64
zrcencf_EncryptFile
zrcencm_EncryptMem
zrcuuct_UCS2toUTF8
zrcuutc_UTF8toUCS2

Sections

.text
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 173KB - Virtual size: 173KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 974B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9334ee5f0c3bb62ce40ee3665eec1920

Headers

File Characteristics

Imports

msvcrt

kernel32

advapi32

core40

nlsrtl33

nl80

ns80

nnfg80

ncr80

Exports

Exports

Sections

.text Size: 29KB - Virtual size: 28KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 3KB - Virtual size: 3KB

.idata Size: 173KB - Virtual size: 173KB

.reloc Size: 1024B - Virtual size: 974B

.text
Size: 29KB - Virtual size: 28KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 3KB - Virtual size: 3KB

.idata
Size: 173KB - Virtual size: 173KB

.reloc
Size: 1024B - Virtual size: 974B