43f2710c5f73e78fb5c112a9b88046740ab044542d436d1ec5dafd7a16c6be3a

Sharing

Copy URL Twitter E-mail

General

Target

43f2710c5f73e78fb5c112a9b88046740ab044542d436d1ec5dafd7a16c6be3a
Size

852KB
MD5

8c7d6390805d1eb1f5db0b82a41dcdd7
SHA1

f96705ba688bc1a2d0446ace4bf5f18680471dc2
SHA256

43f2710c5f73e78fb5c112a9b88046740ab044542d436d1ec5dafd7a16c6be3a
SHA512

50844e5b534011389d851cc0de302b968ed8e0d45fc30f5ef1d49e38565fda45e41b07a3c1df8a98a687bc34b9469c5ff12c2e09cb0551b3e65a444d46932206
SSDEEP

24576:FmpcQpRSAbz+0rn39WnzuON+DC3p01TFWs6:FmmC9Drn39WniI+C3p0vWs6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
43f2710c5f73e78fb5c112a9b88046740ab044542d436d1ec5dafd7a16c6be3a

Files

43f2710c5f73e78fb5c112a9b88046740ab044542d436d1ec5dafd7a16c6be3a
.dll windows:6 windows x86 arch:x86

e3761e8aa1c7849d15ceaf67522d772a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\code\otter\otter3\run\Release\DetectSDK.pdb

Imports

kernel32

HeapAlloc
GetProcessHeap
HeapFree
TlsAlloc
GetLastError
CreateEventW
CloseHandle
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
WaitForMultipleObjects
TerminateThread
QueueUserAPC
SetEvent
SleepEx
MultiByteToWideChar
LocalFree
CreateIoCompletionPort
SetWaitableTimer
GetQueuedCompletionStatus
SetLastError
VerSetConditionMask
VerifyVersionInfoW
CreateWaitableTimerW
CreateSemaphoreA
CreateEventA
GetCurrentProcess
DuplicateHandle
ReleaseSemaphore
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObjectEx
TlsGetValue
TlsSetValue
TlsFree
WideCharToMultiByte
FormatMessageW
PostQueuedCompletionStatus
WriteConsoleW
HeapSize
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
HeapReAlloc
SetStdHandle
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleCP
WriteFile
FlushFileBuffers
GetFileSizeEx
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
OpenEventA
ResetEvent
GetCurrentProcessId
RaiseException
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
TryEnterCriticalSection
GetCurrentThreadId
EncodePointer
DecodePointer
LCMapStringEx
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
GetLocaleInfoEx
GetStringTypeW
CompareStringEx
GetCPInfo
WaitForMultipleObjectsEx
Sleep
ResumeThread
GetModuleHandleA
CreateWaitableTimerA
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
CreateFileW
SetEndOfFile
SetFilePointerEx
FindClose
FindNextFileW
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
FreeLibrary
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
GetStdHandle
GetFileType
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
FormatMessageA

ws2_32

WSASetLastError
WSAGetLastError
closesocket
send
connect
socket
ntohs
bind
WSACleanup
WSAStartup
htons
htonl
ntohl
WSAStringToAddressW
WSAAddressToStringW
setsockopt
WSASocketW
WSASendTo
WSASend
WSARecvFrom
ioctlsocket

advapi32

CryptGenRandom
CryptAcquireContextW
CryptReleaseContext

Exports

Exports

detectsdk_create_detector
detectsdk_destroy_detector
detectsdk_fwpack_version
detectsdk_get_detected_nodes
detectsdk_get_version
detectsdk_get_version_str
detectsdk_refresh
detectsdk_set_device_offline_listener
detectsdk_set_device_online_listener
detectsdk_set_node_interface
detectsdk_set_thread_pool_size
detectsdk_start_detector
detectsdk_stop_detector

Sections

.text
Size: 639KB - Virtual size: 638KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 147KB - Virtual size: 147KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e3761e8aa1c7849d15ceaf67522d772a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

ws2_32

advapi32

Exports

Exports

Sections

.text Size: 639KB - Virtual size: 638KB

.rdata Size: 147KB - Virtual size: 147KB

.data Size: 24KB - Virtual size: 28KB

.rsrc Size: 1024B - Virtual size: 952B

.reloc Size: 39KB - Virtual size: 39KB

.text
Size: 639KB - Virtual size: 638KB

.rdata
Size: 147KB - Virtual size: 147KB

.data
Size: 24KB - Virtual size: 28KB

.rsrc
Size: 1024B - Virtual size: 952B

.reloc
Size: 39KB - Virtual size: 39KB