c055abb7eccc1ad9073e4fc8da728be41aa3019b844529d7c5414b38d6c2777a

Sharing

Copy URL Twitter E-mail

General

Target

c055abb7eccc1ad9073e4fc8da728be41aa3019b844529d7c5414b38d6c2777a
Size

738KB
MD5

979580030ee239c384e0b5fc3883c8b0
SHA1

73ea5cf033e20e8338fd259546d6b826ca9d4242
SHA256

c055abb7eccc1ad9073e4fc8da728be41aa3019b844529d7c5414b38d6c2777a
SHA512

da7594b29ae5bb59d83805ab26a8a32bc7a5b544400297f5d2f854046f7070b83d6a60075589a72a3a6a08e3c78e1d1a1f4c70d2245cff995ea47fe7bc385b0f
SSDEEP

12288:aWxi+vovybekxo2km+dpZ+FBwea0aEupkJ61LXQJ:Wuez2k5irwsVuplw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c055abb7eccc1ad9073e4fc8da728be41aa3019b844529d7c5414b38d6c2777a

Files

c055abb7eccc1ad9073e4fc8da728be41aa3019b844529d7c5414b38d6c2777a
.dll windows:1 windows x86 arch:x86

ea7406c920188e426347085bf5f2e99b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

advapi32

RegCloseKey
RegCreateKeyA
RegOpenKeyA
RegQueryValueExA
RegSetValueExA

clarun

AttachThreadToClarion
Cla$ACCEPTED
Cla$ADDqueue
Cla$ADDqueuekey
Cla$AssertFailed
Cla$BSHIFT
Cla$CLEAR
Cla$CLEARqueue
Cla$clearstr
Cla$CLOCK
Cla$CLOSEwindow
Cla$COMMAND
Cla$comparestr
Cla$DATE
Cla$DecAdd
Cla$DecDistinct
Cla$DecDistinctR
Cla$DecDivide
Cla$DecMul
Cla$DELETEqueue
Cla$DPopLong
Cla$DPopReal
Cla$DPopUlong
Cla$DPushLong
Cla$DPushULong
Cla$duplicate
Cla$EndEventLoop
Cla$ERRORCODE
Cla$EVENT
Cla$FileExists
Cla$FREEqueue
Cla$FREEqueuea
Cla$freestr
Cla$FreeUfo
Cla$freewindow
Cla$GetPropS
Cla$GETqueuekey
Cla$GETqueueptr
Cla$init
Cla$Mem2Ufo
Cla$MessageBox
Cla$modulus
Cla$NewMemB
Cla$NewMemT
Cla$NewMemZ
Cla$OPENwindow
Cla$PEEK
Cla$POINTERqueue
Cla$PopCString
Cla$PopReal
Cla$PopString
Cla$PopTemp
Cla$POST
Cla$PushCString
Cla$PushLong
Cla$PushPictDec
Cla$PushPictLong
Cla$PushReal
Cla$PushString
Cla$PUTqueue
Cla$PUTqueuekey
Cla$pwopen
Cla$RANDOM
Cla$RECORDSqueue
Cla$RESUME
Cla$rterr
Cla$SETCOMMAND
Cla$SetPropS
Cla$SetPropV
Cla$SORTqueuekey
Cla$Stack2DStack
Cla$StackALL
Cla$StackCLIP
Cla$StackCompareN
Cla$StackCompareNEQ
Cla$StackConcat
Cla$StackConcatR
Cla$StackErrstr
Cla$StackHeap
Cla$StackINSTRING
Cla$StackLEFT
Cla$StackLen
Cla$StackLOWER
Cla$StackRotate
Cla$StackSUB
Cla$StackUPPER
Cla$START
Cla$StartEventLoop
Cla$STATUSwindow
Cla$STOP
Cla$storecstr
Cla$storestr
Cla$String2Ref
Cla$THREAD
Cla$TODAY
Cla$YIELD
THR$GetInstance
_free
_malloc
_memcpy
_memset
_strdup
__a_chkstk
__e_index
__e_stack
__sysinit
__systerm
__systhrinit
__systhrterm

kernel32

EnterCriticalSection
FreeLibrary
GetComputerNameA
GetLastError
GetProcAddress
GetTickCount
GetTimeZoneInformation
GetVersion
GlobalMemoryStatus
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
OutputDebugStringA
SetErrorMode
Sleep
SleepEx

user32

CallWindowProcA
GetSystemMetrics

wsock32

accept
bind
closesocket
connect
gethostbyaddr
gethostbyname
gethostname
getsockname
htons
inet_addr
inet_ntoa
listen
ntohs
recv
recvfrom
send
sendto
setsockopt
shutdown
socket
WSAAsyncGetHostByName
WSAAsyncSelect
WSACancelAsyncRequest
WSACleanup
WSAGetLastError
WSAStartup

Exports

Exports

NetAutoGetNetName
NetAutoGetServer
NetAutoNotify
NetAutoReceive
NetAutoRemote
NetAutoSendAsync
NetAutoSendBroadCast
NetAutoSendSync
NetAutoSetService
NetBan
NetBase64Decode
NetBase64DecodeEx
NetBase64Encode
NetBase64EncodeEx
NetCharSet
NetCloseCallBackWindow
NetDESDecrypt
NetDESEncrypt
NetDUNAddDUN
NetDUNChangeDUN
NetDUNDeleteDUN
NetDUNDialDUN
NetDUNGetConnections
NetDUNGetConnectionsStatus
NetDUNGetDUNs
NetDUNGetDevices
NetDUNGetLastError
NetDUNHangUp
NetDUNObjectManager
NetDUNRenameDUN
NetDebugTrace
NetErrorStr
NetFreeUniqueEvent
NetGetBanned
NetGetIPInfo
NetGetRegistry
NetGetTimeZone
NetGetUniqueEvent
NetGet_NetCriticalSection
NetIsBanned
NetLoadCallBackWindow
NetMD5
NetMakeHMAC
NetMakeHash
NetOSDesEncrypt
NetOptions
NetPing
NetQuotedPrintableDecode
NetQuotedPrintableEncode
NetSetNotifier_Unused
NetSetRegistry
NetSimpleClose
NetSimpleGetServerConnections
NetSimpleOpen
NetSimpleReceive
NetSimpleResetClientIdleTimeout
NetSimpleSSLGetRemoteCerticate
NetSimpleSSLSwitchToSSL
NetSimpleSend
NetTurnOnLogging
NetUUDecode
NetUnBan

Sections

.text
Size: 276KB - Virtual size: 276KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 115KB - Virtual size: 419KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.cwtls
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.cwdebug
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ea7406c920188e426347085bf5f2e99b

Headers

File Characteristics

Imports

advapi32

clarun

kernel32

user32

wsock32

Exports

Exports

Sections

.text Size: 276KB - Virtual size: 276KB

.data Size: 115KB - Virtual size: 419KB

.cwtls Size: 512B - Virtual size: 1KB

.edata Size: 2KB - Virtual size: 1KB

.idata Size: 4KB - Virtual size: 4KB

.rsrc Size: 6KB - Virtual size: 5KB

.reloc Size: 45KB - Virtual size: 45KB

.cwdebug Size: 512B - Virtual size: 28B

.text
Size: 276KB - Virtual size: 276KB

.data
Size: 115KB - Virtual size: 419KB

.cwtls
Size: 512B - Virtual size: 1KB

.edata
Size: 2KB - Virtual size: 1KB

.idata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 6KB - Virtual size: 5KB

.reloc
Size: 45KB - Virtual size: 45KB

.cwdebug
Size: 512B - Virtual size: 28B