c37c394bb54853f70ec40fe44b0c0916cece374431b6ff2856455443fc704fd5

Sharing

Copy URL Twitter E-mail

General

Target

c37c394bb54853f70ec40fe44b0c0916cece374431b6ff2856455443fc704fd5
Size

943KB
MD5

f2fe376398d5fb84b47f7b49bec06617
SHA1

1287d0fcb9cb6b699e54924107582c79e53e6a83
SHA256

c37c394bb54853f70ec40fe44b0c0916cece374431b6ff2856455443fc704fd5
SHA512

92edfbf9bac02292ae3a8f34e5b91c280e909355d45121f8f2c4d860de803009d768d9717b3464a74b1b081cdbb7bbc519c1dc12b43be5cae1de12c2240b5eff
SSDEEP

24576:ZkLY21d/T9tzJ1r5O4g/YuJrxhupQGFBmxrSX76:MY2pxFfg/YuJrxhupQQBmxOO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c37c394bb54853f70ec40fe44b0c0916cece374431b6ff2856455443fc704fd5

Files

c37c394bb54853f70ec40fe44b0c0916cece374431b6ff2856455443fc704fd5
.dll windows:6 windows x86 arch:x86

53506adac307913efe11a3733ed0e87f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\git\otter\run\Release\restc.pdb

Imports

kernel32

SetWaitableTimer
TlsSetValue
SetLastError
EnterCriticalSection
GetCurrentProcess
CreateWaitableTimerW
ReleaseSemaphore
WaitForMultipleObjects
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetQueuedCompletionStatus
WaitForSingleObject
DuplicateHandle
PostQueuedCompletionStatus
CreateEventW
FormatMessageA
SetEvent
TerminateThread
WaitForSingleObjectEx
CloseHandle
QueueUserAPC
DeleteCriticalSection
VerSetConditionMask
SleepEx
VerifyVersionInfoW
TlsGetValue
CreateSemaphoreA
CreateEventA
CreateIoCompletionPort
QueryPerformanceFrequency
QueryPerformanceCounter
TlsFree
WideCharToMultiByte
LocalFree
TlsAlloc
GetLastError
Sleep
WriteConsoleW
HeapSize
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
HeapReAlloc
SetStdHandle
GetTimeZoneInformation
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
OpenEventA
ResetEvent
GetCurrentProcessId
HeapFree
HeapAlloc
GetProcessHeap
WaitForMultipleObjectsEx
InitializeCriticalSection
SetThreadAffinityMask
VerifyVersionInfoA
GetProcessAffinityMask
LoadLibraryA
GetVersionExA
GetProcAddress
FreeLibrary
TryEnterCriticalSection
ReadFile
CancelIo
WriteFile
DeviceIoControl
CreateFileA
GetOverlappedResult
GetModuleHandleW
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentThreadId
GetSystemTimeAsFileTime
RaiseException
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
EncodePointer
DecodePointer
MultiByteToWideChar
LCMapStringEx
GetLocaleInfoEx
GetStringTypeW
CompareStringEx
GetCPInfo
CreateFileW
GetFileAttributesExW
SetEndOfFile
SetFilePointerEx
FindClose
FindNextFileW
AreFileApisANSI
ResumeThread
GetModuleHandleA
CreateWaitableTimerA
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
GetStdHandle
GetFileType
GetFileSizeEx
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
GetDateFormatW
FormatMessageW

ws2_32

socket
htons
__WSAFDIsSet
accept
bind
WSAIoctl
closesocket
WSASend
select
ntohl
listen
WSASetLastError
send
getaddrinfo
getsockname
ntohs
connect
WSARecv
getsockopt
htonl
freeaddrinfo
ioctlsocket
setsockopt
WSAGetLastError
WSACleanup
WSAStartup
WSASocketW

advapi32

CryptGenRandom
CryptAcquireContextW
OpenServiceA
OpenSCManagerW
CloseServiceHandle
CryptReleaseContext

Exports

Exports

restc_add_header
restc_cleanup
restc_create_connection
restc_create_headers
restc_create_usb_connection
restc_create_usb_connection2
restc_del
restc_destroy_connection
restc_destroy_headers
restc_enumerate_usb_devices
restc_find_header
restc_get
restc_get_file
restc_get_header
restc_get_header_num
restc_get_version
restc_post
restc_post_buffer
restc_post_file
restc_put
restc_set_authroization
restc_set_thread_num
restc_set_timeout
restc_usb_grab

Sections

.text
Size: 717KB - Virtual size: 717KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 154KB - Virtual size: 153KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

53506adac307913efe11a3733ed0e87f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

ws2_32

advapi32

Exports

Exports

Sections

.text Size: 717KB - Virtual size: 717KB

.rdata Size: 154KB - Virtual size: 153KB

.data Size: 25KB - Virtual size: 35KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 43KB - Virtual size: 43KB

.text
Size: 717KB - Virtual size: 717KB

.rdata
Size: 154KB - Virtual size: 153KB

.data
Size: 25KB - Virtual size: 35KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 43KB - Virtual size: 43KB