aa31999669f4fe1046f51773c202eaa9

Sharing

Copy URL Twitter E-mail

General

Target

aa31999669f4fe1046f51773c202eaa9
Size

391KB
MD5

aa31999669f4fe1046f51773c202eaa9
SHA1

62b47133c40366a75c953a61568d2eef07a6f880
SHA256

59ac9fba1e9cef7e31624d748f4de009d2a62d101aff0e744b019ca81c01bda5
SHA512

2edbcd71d1cd474615b03804aab22d22983315b4485d465b6c4551f791a233551af6edfa8f8401c51c050ac3788be5a305486ca44b34d81628fcc019a8390db2
SSDEEP

12288:16nB72Sf3+qWsnNmkjw6ZoEgkF1bpNivXl/V:IH8EN1dNivX1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aa31999669f4fe1046f51773c202eaa9

Files

aa31999669f4fe1046f51773c202eaa9
.exe windows:6 windows x86 arch:x86

15c0edd69546fcaf03ec0c62c372e473

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Projects\deviceClient\clrwDiagService\Release\clearwireDeviceDiagnosticsService.pdb

Imports

wsock32

WSAStartup
WSACleanup
closesocket
WSAGetLastError
select
inet_ntoa
__WSAFDIsSet
listen
accept
recvfrom
sendto
WSASetLastError
gethostbyname
socket
connect
setsockopt
getsockopt
htons
bind
ntohs
getsockname
send
recv

wldap32

ord46
ord27
ord301
ord33
ord200
ord79
ord35
ord32
ord22
ord211
ord143
ord60
ord50
ord26
ord30
ord41

iphlpapi

GetAdaptersAddresses

libxvi010

OpenWiMAXDevice
SendWiMAXMessage
RegisterCallback
CloseWiMAXDevice

kernel32

GetStringTypeW
GetStringTypeA
InitializeCriticalSectionAndSpinCount
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetCurrentDirectoryA
GetFullPathNameA
FlushFileBuffers
SetStdHandle
GetModuleHandleA
LCMapStringW
LCMapStringA
GetConsoleCP
VirtualAlloc
GetCurrentProcessId
QueryPerformanceCounter
VirtualFree
HeapCreate
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
WriteFile
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
InterlockedDecrement
Sleep
GetLastError
GetModuleFileNameA
GetSystemTime
WaitForSingleObject
SetEvent
CreateEventA
CreateMutexA
ReleaseMutex
CloseHandle
GetVersionExA
SetLastError
FormatMessageA
SleepEx
DuplicateHandle
GetCurrentProcess
WaitForMultipleObjects
GetExitCodeThread
TerminateThread
ReadFile
PeekNamedPipe
GetFileType
GetStdHandle
FreeLibrary
GetProcAddress
LoadLibraryA
GetTickCount
ExpandEnvironmentStringsA
GetLocaleInfoA
GetTimeZoneInformation
CompareStringA
CompareStringW
SetEnvironmentVariableA
HeapSize
SetEndOfFile
GetProcessHeap
GetConsoleMode
PeekConsoleInputA
GetNumberOfConsoleInputEvents
EnterCriticalSection
LeaveCriticalSection
MoveFileA
DeleteFileA
GetSystemTimeAsFileTime
ExitThread
GetCurrentThreadId
CreateThread
GetCommandLineA
HeapReAlloc
HeapAlloc
HeapFree
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileInformationByHandle
SetFilePointer
FindClose
GetDriveTypeA
FindFirstFileA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
CreateFileA
DeleteCriticalSection
SetHandleCount
GetStartupInfoA
GetModuleHandleW
ExitProcess
RtlUnwind
MultiByteToWideChar
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement

advapi32

ControlService
OpenSCManagerA
QueryServiceStatus
CreateServiceA
DeleteService
CloseServiceHandle
OpenServiceA
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA

Sections

.text
Size: 308KB - Virtual size: 308KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

15c0edd69546fcaf03ec0c62c372e473

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

wsock32

wldap32

iphlpapi

libxvi010

kernel32

advapi32

Sections

.text Size: 308KB - Virtual size: 308KB

.rdata Size: 56KB - Virtual size: 55KB

.data Size: 5KB - Virtual size: 120KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 20KB - Virtual size: 20KB

.text
Size: 308KB - Virtual size: 308KB

.rdata
Size: 56KB - Virtual size: 55KB

.data
Size: 5KB - Virtual size: 120KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 20KB - Virtual size: 20KB