b4a83d750ab58d72e5ff522f9e6d77d8

Sharing

Copy URL Twitter E-mail

General

Target

b4a83d750ab58d72e5ff522f9e6d77d8
Size

208KB
MD5

b4a83d750ab58d72e5ff522f9e6d77d8
SHA1

70b26b4e19f9a7bd9b673d4273b06ba505eba5bd
SHA256

bb8c49eba390aff6d1a116b7241bc43f5a866e1609c50687fed10f28e1a33627
SHA512

50d02b9aa1ed0405176292e6c7725a6420dbfbe55f68236f1460a24689dc55ad39103781dc103e3a7356799e6e857dd34d5bc69fcbbd27b820040c25dd505f56
SSDEEP

6144:b1TyRICfzZQVG5zLD45eEhIv5KTBIUXuTyEzVa:bQRvfzZQVCHD4kEW5KTC0u2Eg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b4a83d750ab58d72e5ff522f9e6d77d8

Files

b4a83d750ab58d72e5ff522f9e6d77d8
.dll windows:6 windows x86 arch:x86

ecea502ae8d6b6cf637b892f3a6b808d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

F:\myapp\CcRemote\bin\server\CcMainDll.pdb

Imports

wininet

InternetCloseHandle
InternetOpenA
InternetReadFile
InternetOpenUrlA

shlwapi

SHDeleteKeyA

kernel32

HeapAlloc
GetLocalTime
CreateFileMappingA
GetProcessHeap
MapViewOfFile
LocalSize
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GlobalSize
OutputDebugStringA
CreatePipe
GetStartupInfoA
TerminateProcess
DisconnectNamedPipe
PeekNamedPipe
WaitForMultipleObjects
lstrcmpiA
QueryDosDeviceA
K32GetProcessImageFileNameA
CreateToolhelp32Snapshot
Process32First
Process32Next
GetCurrentProcessId
GetCurrentThreadId
SetUnhandledExceptionFilter
CreateMutexA
SetErrorMode
OpenEventA
ReleaseMutex
FreeConsole
FlushFileBuffers
HeapSize
SetStdHandle
SetFilePointerEx
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
HeapFree
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
GetFileType
GetStdHandle
HeapReAlloc
LCMapStringW
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
InterlockedFlushSList
RaiseException
RtlUnwind
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
MoveFileExA
GetTickCount
GetSystemDirectoryA
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
OpenProcess
GetCurrentProcess
SetLastError
GetModuleFileNameA
CreateDirectoryA
GetDiskFreeSpaceExA
WriteConsoleW
CreateProcessA
LocalReAlloc
RemoveDirectoryA
GetFileSize
LocalFree
GetLogicalDriveStringsA
DeleteFileA
CreateFileA
GetFileAttributesA
GetLastError
LocalAlloc
GetVolumeInformationA
FindClose
SetFilePointer
FindNextFileA
GetDriveTypeA
WriteFile
FindFirstFileA
MoveFileA
ReadFile
GetVersionExA
WideCharToMultiByte
MultiByteToWideChar
FreeLibrary
GetProcAddress
LoadLibraryA
lstrlenA
lstrcatA
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
VirtualAlloc
VirtualFree
EnterCriticalSection
ResetEvent
lstrcpyA
Sleep
CancelIo
ResumeThread
CreateThread
WaitForSingleObject
SetEvent
CloseHandle
TerminateThread
CreateEventA
GetConsoleCP
IsProcessorFeaturePresent
UnhandledExceptionFilter
GetConsoleMode
DecodePointer
UnmapViewOfFile
CreateFileW
GetCPInfo

user32

SetWindowsHookExA
GetKeyNameTextA
GetActiveWindow
CallNextHookEx
LoadCursorA
DestroyCursor
BlockInput
SystemParametersInfoA
SendMessageA
wsprintfA
SetCapture
WindowFromPoint
UnhookWindowsHookEx
keybd_event
MapVirtualKeyA
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
GetClipboardData
GetSystemMetrics
GetCursorInfo
DispatchMessageA
TranslateMessage
GetMessageA
GetWindowTextA
mouse_event
ReleaseDC
SetRect
CharNextA
GetDC
SetCursorPos
GetThreadDesktop
GetCursorPos
SetProcessWindowStation
OpenWindowStationA
GetProcessWindowStation
CreateWindowExA
GetUserObjectInformationA
SetThreadDesktop
ExitWindowsEx
CloseDesktop
OpenDesktopA
OpenInputDesktop
InternalGetWindowText
IsWindow
ShowWindow
PostMessageA
EnumWindows
GetWindowThreadProcessId
IsWindowVisible
GetDesktopWindow

gdi32

CreateDIBSection
SelectObject
DeleteDC
GetDIBits
CreateCompatibleBitmap
BitBlt
DeleteObject
CreateCompatibleDC

advapi32

RegOpenKeyExA
RegisterServiceCtrlHandlerA
SetServiceStatus
UnlockServiceDatabase
ChangeServiceConfigA
LockServiceDatabase
StartServiceA
QueryServiceConfigA
EnumServicesStatusA
RegQueryInfoKeyA
RegDeleteKeyA
RegCreateKeyExA
RegEnumValueA
RegEnumKeyExA
SetSecurityDescriptorDacl
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
InitializeAcl
GetLengthSid
AddAccessAllowedAce
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
CloseEventLog
ClearEventLogA
OpenEventLogA
RegQueryValueExA
RegOpenKeyA
RegSetValueExA
CloseServiceHandle
DeleteService
ControlService
QueryServiceStatus
OpenServiceA
OpenSCManagerA
RegCloseKey
RegQueryValueA

shell32

SHGetFileInfoA

winmm

waveInReset
waveOutWrite
waveInGetNumDevs
waveInOpen
waveInUnprepareHeader
waveInClose
waveOutReset
waveOutUnprepareHeader
waveInStop
waveInPrepareHeader
waveInAddBuffer
waveInStart
waveOutGetNumDevs
waveOutOpen
waveOutPrepareHeader
waveOutClose

ws2_32

select
socket
ntohs
connect
recv
htons
setsockopt
WSAStartup
gethostbyname
closesocket
WSAIoctl
WSACleanup
gethostname
getsockname
send

imm32

ImmGetContext
ImmReleaseContext
ImmGetCompositionStringA

avicap32

capGetDriverDescriptionA
capCreateCaptureWindowA

msvfw32

ICClose
ICCompressorFree
ICSeqCompressFrameEnd
ICSendMessage
ICOpen
ICSeqCompressFrame
ICSeqCompressFrameStart

Exports

Exports

FirstRun
MainRun
ServiceMain
TestFun

Sections

.text
Size: 143KB - Virtual size: 143KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ecea502ae8d6b6cf637b892f3a6b808d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

wininet

shlwapi

kernel32

user32

gdi32

advapi32

shell32

winmm

ws2_32

imm32

avicap32

msvfw32

Exports

Exports

Sections

.text Size: 143KB - Virtual size: 143KB

.rdata Size: 51KB - Virtual size: 51KB

.data Size: 3KB - Virtual size: 7KB

.rsrc Size: 512B - Virtual size: 248B

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 143KB - Virtual size: 143KB

.rdata
Size: 51KB - Virtual size: 51KB

.data
Size: 3KB - Virtual size: 7KB

.rsrc
Size: 512B - Virtual size: 248B

.reloc
Size: 8KB - Virtual size: 8KB