Turla[.]rar | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Turla.rar
Size

1.9MB
MD5

cf40c5519a4f8b69c95229b1c325e8b6
SHA1

abc4ca896859dffad550b78ce54fb4d9f934347a
SHA256

1557159ed0ac0a1109a76f07b3e7f00697e577b28390171eac15c63c3b145ef1
SHA512

a483274d936ffc76296a301279c6bd7257795aed009c7a978de34826e770fd94b750cdc180d02e9a67088be9ed806d05f6529ffc9edb8e5c6c9a1302dd1227a3
SSDEEP

49152:SR4+WQDog9W4g6mqjSNPvMeWlkZzW6qJDxRV2NPYkiv/hmk/nN+L:u4+xp9HmqITWCuePdyEk/N+

Score

3^/10

Malware Config

Signatures

Unsigned PE 10 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Turla/CarbonImplant.bin
unpack001/Turla/KazuarRAT.bin
unpack001/Turla/NCSC.bin
unpack001/Turla/Nautilus Implant.bin
unpack001/Turla/NeuronImplant2018.bin
unpack001/Turla/OutlookBackdoor.bin
unpack001/Turla/OutlookBackdoor2.bin
unpack001/Turla/TurlaAgent.exe
unpack001/Turla/TurlaDropper.bin
unpack001/Turla/TurlaKeylogger.bin

Files

Turla.rar
.rar

Password: 123
Turla/CarbonImplant.bin
.exe windows:5 windows x64 arch:x64

Password: 123

f9410b77f2ed92c5538775ecf2c381c6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

CreateFileW
WritePrivateProfileStringW
FindClose
LockResource
DeviceIoControl
GetFileAttributesW
GetFileTime
CloseHandle
GetVolumeInformationW
ExpandEnvironmentStringsW
__chkstk
GetVersionExW
SizeofResource
WriteFile
SetFileTime
GetPrivateProfileStringW
GetProcessHeap
LoadResource
HeapAlloc
FindResourceW
FindFirstFileW
GetEnvironmentVariableW
LocalFree
lstrcatW
GetLastError
VerifyVersionInfoW
HeapFree
VerSetConditionMask
FindNextFileW

user32

wsprintfW

advapi32

OpenServiceW
RegCloseKey
RegOpenKeyExW
ChangeServiceConfigW
StartServiceW
ChangeServiceConfig2W
RegOpenKeyExA
InitializeSecurityDescriptor
RegQueryValueExW
RegCreateKeyExW
OpenSCManagerW
DeleteService
CloseServiceHandle
CreateServiceW
ConvertStringSecurityDescriptorToSecurityDescriptorA
MakeAbsoluteSD
SetFileSecurityW
RegSetValueExW

msvcrt

_wcsicmp
memmove
free
malloc
wprintf
printf
rand
srand
wcsncmp
_time64
__C_specific_handler
_XcptFilter
sprintf
_exit
_cexit
exit
__winitenv
__wgetmainargs
_initterm
__setusermatherr
_commode
_fmode
__set_app_type
_c_exit
memset
memcpy

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 600KB - Virtual size: 600KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Turla/KazuarRAT.bin
.dll windows:4 windows x86 arch:x86

Password: 123

682156c4380c216ff8cb766a2f2e8817

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

CreateThread
GetModuleFileNameA
LoadLibraryA
lstrcmpiA

shlwapi

PathFindFileNameA

user32

CallNextHookEx

Exports

Exports

DllMain@12
HookProc@12

Sections

.text
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.wtf
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 320B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Turla/NCSC.bin
.exe windows:4 windows x86 arch:x86

Password: 123

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\Develop\sps\neuron2\neuron2\obj\Release\neuron2.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Turla/Nautilus Implant.bin
.dll windows:6 windows x64 arch:x64

Password: 123

468451b8d57563f8791acd5aad32d23a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
SetFilePointer
ReadFile
GetLastError
CreateThread
GetCurrentProcessId
CreateEventA
GetTempPathA
CreateProcessA
TerminateProcess
Sleep
GetFileSize
DeleteFileA
CreateFileA
WaitForSingleObject
SetEndOfFile
CreateFileW
HeapSize
WriteConsoleW
GetFileAttributesA
MultiByteToWideChar
WideCharToMultiByte
ReleaseMutex
CreateMutexA
DuplicateHandle
SetEvent
GetCurrentProcess
OpenProcess
MapViewOfFile
LocalAlloc
WaitForMultipleObjects
CreateFileMappingA
SetLastError
GetProcAddress
UnmapViewOfFile
ResetEvent
WriteFile
HeapAlloc
HeapFree
GetProcessHeap
GetTempFileNameA
GetExitCodeThread
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
GetCommandLineA
GetCurrentThreadId
HeapReAlloc
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
RtlUnwindEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
AreFileApisANSI
GetStdHandle
GetModuleFileNameW
GetFileType
DeleteCriticalSection
GetModuleFileNameA
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetConsoleCP
GetConsoleMode
FlushFileBuffers
ReadConsoleW
RaiseException
SetFilePointerEx
LoadLibraryExW
OutputDebugStringW
GetStringTypeW
CompareStringW
LCMapStringW
SetStdHandle
CreateDirectoryA

shell32

SHFileOperationA

ws2_32

connect

httpapi

HttpReceiveHttpRequest
HttpRemoveUrl
HttpAddUrl
HttpCreateHttpHandle
HttpInitialize
HttpSendResponseEntityBody
HttpSendHttpResponse
HttpReceiveRequestEntityBody

wininet

HttpQueryInfoW
InternetOpenA
HttpOpenRequestA
InternetReadFile
InternetCloseHandle
InternetConnectA
HttpSendRequestA

advapi32

GetSidSubAuthority
GetSidSubAuthorityCount
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorA
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
OpenProcessToken

Exports

Exports

MyFunction
ReflectiveLoader

Sections

.text
Size: 447KB - Virtual size: 446KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 123KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Turla/NeuronImplant2018.bin
.dll windows:6 windows x86 arch:x86

Password: 123

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 140B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 138KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Turla/OutlookBackdoor.bin
.dll regsvr32 windows:5 windows x86 arch:x86

Password: 123

ffdd7d29384f862df16f05b993adefd4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WriteFile
HeapReAlloc
HeapAlloc
WaitForSingleObject
GetFileAttributesW
MultiByteToWideChar
SetLastError
VirtualFree
LoadLibraryA
VirtualProtect
DeleteCriticalSection
WideCharToMultiByte
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
CreateDirectoryW
GetModuleFileNameW
GetFullPathNameW
ExpandEnvironmentStringsW
GetCurrentProcess
VirtualAlloc
GetSystemTime
SystemTimeToFileTime
GetModuleHandleA
CreateEventA
SetEvent
CreateFileA
FormatMessageA
GetProcAddress
CreateToolhelp32Snapshot
Thread32First
SetFilePointer
GetCurrentProcessId
GetComputerNameA
lstrlenA
CreateSemaphoreA
CreateProcessA
TerminateProcess
lstrcatA
ReleaseSemaphore
CreateDirectoryA
FindFirstFileA
GetCurrentDirectoryA
GetTempPathA
DeleteFileA
FreeLibrary
GetTickCount
GetModuleHandleW
GetProcessId
FlushInstructionCache
LocalAlloc
CompareStringW
CompareStringA
SetEndOfFile
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
InitializeCriticalSectionAndSpinCount
GetLocaleInfoW
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetCurrentThreadId
ReadFile
GetFileSize
CreateFileW
GetProcessHeap
HeapFree
GetLocalTime
DeleteFileW
GetEnvironmentVariableW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetLastError
LoadLibraryW
Sleep
CreateThread
Thread32Next
CloseHandle
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
VirtualQuery
SetEnvironmentVariableW
SetEnvironmentVariableA
IsValidCodePage
GetOEMCP
GetACP
FlushFileBuffers
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetTimeFormatA
GetDateFormatA
GetTimeZoneInformation
GetCommandLineA
RaiseException
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetHandleCount
GetFileType
GetStartupInfoA
HeapSize
ExitProcess
HeapCreate
HeapDestroy
GetConsoleCP
GetConsoleMode

user32

wsprintfA
EnumThreadWindows
EnumChildWindows
GetActiveWindow
InvalidateRect
SendMessageA
PostMessageA
IsWindowVisible
CallWindowProcA
SetWindowLongA
GetWindowLongA
GetClassNameA
MessageBoxA

advapi32

RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
GetTokenInformation
OpenProcessToken
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW

shell32

SHFileOperationA

psapi

GetModuleInformation

mapi32

ord13
ord140

Exports

Exports

DllGetClassObject
DllRegisterServer
DllUnregisterServer
Install
TBP_Finalize
TBP_GetName
TBP_GetStatus
TBP_Initialize
Uninstall
install
uninstall

Sections

.text
Size: 295KB - Virtual size: 294KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Turla/OutlookBackdoor2.bin
.dll regsvr32 windows:5 windows x86 arch:x86

Password: 123

76768716dc7a613d452ff4d177e13797

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WriteFile
HeapReAlloc
FindFirstChangeNotificationW
HeapAlloc
WaitForSingleObject
FindCloseChangeNotification
GetFileAttributesW
MultiByteToWideChar
GetLastError
SetLastError
FindNextChangeNotification
DeleteFileW
VirtualFree
DeleteCriticalSection
WideCharToMultiByte
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileW
FindNextFileW
CreateDirectoryW
GetModuleFileNameW
GetFullPathNameW
ExpandEnvironmentStringsW
GetCurrentProcess
VirtualAlloc
VirtualProtect
GetSystemTime
SystemTimeToFileTime
GetModuleHandleA
LoadLibraryA
GetVersionExA
CreateEventA
SetEvent
CreateFileA
FormatMessageA
GetProcAddress
CreateToolhelp32Snapshot
SetFilePointer
Thread32Next
GetCurrentProcessId
WaitForMultipleObjects
CreateWaitableTimerA
SetWaitableTimer
TerminateProcess
FreeLibrary
GetTickCount
LocalAlloc
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
InitializeCriticalSectionAndSpinCount
GetLocaleInfoW
VirtualQuery
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
ReadFile
GetFileSize
CreateFileW
GetProcessHeap
HeapFree
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
Sleep
CreateThread
Thread32First
CloseHandle
GetLocaleInfoA
GetUserDefaultLCID
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitThread
ResumeThread
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCommandLineA
RaiseException
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
GetStdHandle
GetModuleFileNameA
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetHandleCount
GetFileType
GetStartupInfoA
HeapSize
ExitProcess
GetConsoleCP
GetConsoleMode
FlushFileBuffers
HeapCreate
HeapDestroy
GetACP
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter

user32

EnumThreadWindows
EnumChildWindows
InvalidateRect
SendMessageA
DefWindowProcA
DestroyWindow
CreateWindowExA
RegisterClassA
PostMessageA
IsWindowVisible
CallWindowProcA
SetWindowLongA
GetWindowLongA
GetClassNameA
GetActiveWindow

advapi32

RegSetValueExA
RegCreateKeyExA
GetTokenInformation
OpenProcessToken
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegQueryValueExA

oleaut32

SysAllocStringLen
SysFreeString

psapi

GetModuleInformation

Exports

Exports

DllGetClassObject
DllRegisterServer
DllUnregisterServer
Install
TBP_Finalize
TBP_GetName
TBP_GetStatus
TBP_Initialize
Uninstall
install
uninstall

Sections

.text
Size: 213KB - Virtual size: 213KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Turla/TurlaAgent.exe
.dll windows:4 windows x86 arch:x86

Password: 123

9d0d6daa47d6e6f2d80eb05405944f87

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcAddress
LoadLibraryA
FindClose
FindFirstFileA
UnmapViewOfFile
GetLastError
MapViewOfFile
CreateFileMappingA
GetFileSize
lstrcmpA
GetTempFileNameA
GetTempPathA
lstrlenA
SetLastError
SetFileAttributesA
CopyFileA
WriteFile
GetPrivateProfileStringA
FindNextFileA
OpenEventA
GetVolumeInformationA
GetDriveTypeA
ExitProcess
GetModuleHandleA
GetModuleFileNameA
SetFilePointer
ReadFile
CreateProcessA
Sleep
lstrcatA
GetSystemDirectoryA
GetSystemTime
SetFileTime
GetTempPathW
FreeLibrary
GetEnvironmentVariableW
GetComputerNameW
GetTimeZoneInformation
GetLocalTime
MultiByteToWideChar
lstrcatW
lstrlenW
GetVersionExA
GetTickCount
GetComputerNameA
WaitForSingleObject
ResumeThread
TerminateProcess
FileTimeToSystemTime
GetWindowsDirectoryA
GetEnvironmentVariableA
CreateDirectoryA
CreateMutexA
ReleaseMutex
OutputDebugStringA
GetFileTime
InterlockedIncrement
InterlockedDecrement
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetStringTypeW
GetStringTypeA
DeleteFileA
lstrcpyA
CreateFileA
GetFileInformationByHandle
CloseHandle
GetFileAttributesA
FileTimeToLocalFileTime
FileTimeToDosDateTime
GetWindowsDirectoryW
IsBadCodePtr
IsBadReadPtr
GetOEMCP
GetACP
GetCPInfo
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
LCMapStringW
LCMapStringA
WideCharToMultiByte
UnhandledExceptionFilter
HeapSize
SetUnhandledExceptionFilter
FlushFileBuffers
GetCurrentProcess
GetStartupInfoA
GetStdHandle
HeapAlloc
HeapFree
GetFileType
EnterCriticalSection
LeaveCriticalSection
RaiseException
RtlUnwind
CreateThread
TlsSetValue
TlsGetValue
ExitThread
GetCommandLineA
GetVersion
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
InitializeCriticalSection
DeleteCriticalSection
GetCurrentThreadId
TlsAlloc
TlsFree
SetStdHandle
SetEndOfFile
SetHandleCount

user32

RegisterClassExA
CreateWindowExA
DefWindowProcA
CharLowerBuffA
wsprintfA
wsprintfW
GetMessageA
TranslateMessage
DispatchMessageA

advapi32

RegCreateKeyA
RegDeleteValueA
RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
RegEnumValueA
RegCloseKey

rpcrt4

UuidToStringA
UuidCreate
RpcStringFreeA

ws2_32

inet_ntoa
gethostbyname
WSAStartup
WSACleanup

Exports

Exports

Entry
InstallM
InstallS

Sections

.text
Size: 128KB - Virtual size: 125KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Turla/TurlaDropper.bin
.exe windows:5 windows x86 arch:x86

05cb4e6d3d97087700002cadc74908c5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WaitForSingleObject
GetFileAttributesW
GetModuleFileNameW
GetLastError
SetLastError
GetModuleFileNameA
CreateFileA
SetFileTime
InitializeCriticalSection
LeaveCriticalSection
GetSystemDirectoryA
EnterCriticalSection
GetFileTime
DeleteCriticalSection
CloseHandle
HeapAlloc
WideCharToMultiByte
HeapFree
GetSystemTimeAsFileTime
GetCommandLineA
GetStartupInfoA
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
GetModuleHandleW
Sleep
ExitProcess
WriteFile
GetStdHandle
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
RtlUnwind
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
SetFilePointer
GetTimeZoneInformation
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
InitializeCriticalSectionAndSpinCount
LoadLibraryA
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
FlushFileBuffers
HeapSize
SetEndOfFile
GetProcessHeap
ReadFile
CompareStringA
CompareStringW
SetEnvironmentVariableA
VirtualQuery
GetProcAddress
LoadLibraryW
GetCPInfo
GetModuleHandleA
RaiseException

user32

DefWindowProcA
EndDialog
CreateWindowExA
GetWindowLongA
MessageBoxA
TranslateMessage
SendMessageA
SetFocus
LoadIconA
LoadMenuA
KillTimer
PostQuitMessage
RegisterClassExA
SetTimer
GetMessageA
wsprintfW
wsprintfA
SetMenu
DispatchMessageA
SetWindowTextA
LoadCursorA
DialogBoxParamA
ShowWindow

gdi32

GetStockObject

advapi32

GetUserNameA

Sections

.text
Size: 126KB - Virtual size: 125KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 383KB - Virtual size: 390KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Turla/TurlaKeylogger.bin
.dll windows:5 windows x64 arch:x64

94e4cb53a59c210cf3bda6a0cd66f941

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GetProcAddress
GetModuleHandleW
Sleep
RtlUnwindEx
GetCurrentThreadId
FlsSetValue
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
GetLastError
FlsAlloc
HeapFree
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
HeapReAlloc
WriteFile
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
HeapSize

Sections

.text
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 644B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: 123

Password: 123

f9410b77f2ed92c5538775ecf2c381c6

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

msvcrt

Sections

.text Size: 16KB - Virtual size: 16KB

.rdata Size: 16KB - Virtual size: 16KB

.data Size: 4KB - Virtual size: 4KB

.pdata Size: 4KB - Virtual size: 4KB

.rsrc Size: 600KB - Virtual size: 600KB

.reloc Size: 4KB - Virtual size: 4KB

Password: 123

682156c4380c216ff8cb766a2f2e8817

Headers

File Characteristics

Imports

kernel32

shlwapi

user32

Exports

Exports

Sections

.text Size: 512B - Virtual size: 64B

.wtf Size: 4KB - Virtual size: 4KB

.rdata Size: 512B - Virtual size: 16B

.edata Size: 512B - Virtual size: 92B

.idata Size: 512B - Virtual size: 320B

.reloc Size: 512B - Virtual size: 48B

Password: 123

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 31KB - Virtual size: 30KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

Password: 123

468451b8d57563f8791acd5aad32d23a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

shell32

ws2_32

httpapi

wininet

advapi32

Exports

Exports

Sections

.text Size: 447KB - Virtual size: 446KB

.rdata Size: 123KB - Virtual size: 122KB

.data Size: 11KB - Virtual size: 29KB

.pdata Size: 17KB - Virtual size: 16KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 4KB - Virtual size: 3KB

Password: 123

Headers

DLL Characteristics

File Characteristics

Sections

.rdata Size: 512B - Virtual size: 140B

.rsrc Size: 138KB - Virtual size: 138KB

.text
Size: 16KB - Virtual size: 16KB

.rdata
Size: 16KB - Virtual size: 16KB

.data
Size: 4KB - Virtual size: 4KB

.pdata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 600KB - Virtual size: 600KB

.reloc
Size: 4KB - Virtual size: 4KB

.text
Size: 512B - Virtual size: 64B

.wtf
Size: 4KB - Virtual size: 4KB

.rdata
Size: 512B - Virtual size: 16B

.edata
Size: 512B - Virtual size: 92B

.idata
Size: 512B - Virtual size: 320B

.reloc
Size: 512B - Virtual size: 48B

.text
Size: 31KB - Virtual size: 30KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 447KB - Virtual size: 446KB

.rdata
Size: 123KB - Virtual size: 122KB

.data
Size: 11KB - Virtual size: 29KB

.pdata
Size: 17KB - Virtual size: 16KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 4KB - Virtual size: 3KB

.rdata
Size: 512B - Virtual size: 140B

.rsrc
Size: 138KB - Virtual size: 138KB

.text
Size: 295KB - Virtual size: 294KB

.rdata
Size: 45KB - Virtual size: 45KB

.data
Size: 14KB - Virtual size: 1.0MB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 22KB - Virtual size: 21KB

.text
Size: 213KB - Virtual size: 213KB

.rdata
Size: 42KB - Virtual size: 42KB

.data
Size: 9KB - Virtual size: 18KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 16KB - Virtual size: 16KB

.text
Size: 128KB - Virtual size: 125KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 20KB - Virtual size: 29KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 12KB - Virtual size: 9KB

.text
Size: 126KB - Virtual size: 125KB

.rdata
Size: 12KB - Virtual size: 12KB