4bdc913cef96b0abd0c1a8231a7961ac901fc9c28f87bba3b8c59e6928c0cda4

Sharing

Copy URL Twitter E-mail

General

Target

4bdc913cef96b0abd0c1a8231a7961ac901fc9c28f87bba3b8c59e6928c0cda4
Size

81KB
MD5

7753da1d7466f251b60673841a97ac5a
SHA1

2dd2e2fd578d64461e89f70cf85224c36fb3a442
SHA256

4bdc913cef96b0abd0c1a8231a7961ac901fc9c28f87bba3b8c59e6928c0cda4
SHA512

149f5a2adab9e20957b5aeaa8d4722ac04f2b6acdf5704821eab117468dc395320823c38a262bb3913530e07f622f266ba8020e7ad9c05ab20daafe41c6a461b
SSDEEP

1536:Mp8caLqLf8GOEc7SBz3H47KGToSnkt6ZbQsWEcdSkzgVsZph:Nca6fqE6OaKGToGJcSkzgqZp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4bdc913cef96b0abd0c1a8231a7961ac901fc9c28f87bba3b8c59e6928c0cda4

Files

4bdc913cef96b0abd0c1a8231a7961ac901fc9c28f87bba3b8c59e6928c0cda4
.dll windows:6 windows x86 arch:x86

08833e753de2709e4b619a59efe79a1c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

G:\project\APT\U盘劫持\new\u2ec\Release\u2ec.pdb

Imports

kernel32

CreateFileA
GetLastError
ExitProcess
GetModuleFileNameA
GetFileSize
VirtualAlloc
ReadFile
CloseHandle
DisableThreadLibraryCalls
WriteConsoleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
RtlUnwind
InterlockedFlushSList
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
DecodePointer

Exports

Exports

CheckUsbService
ClientAddRemoteDev
ClientAddRemoteDevEx
ClientAddRemoteDevManually
ClientAddRemoteDevManuallyEx
ClientEnumAvailRemoteDev
ClientEnumAvailRemoteDevOnServer
ClientEnumAvailRemoteDevOnServerTimeout
ClientEnumRemoteDevOverRdp
ClientGetConnectedDevValueByName
ClientGetCurrentSessionId
ClientGetRdpAutoconnect
ClientGetRdpIsolation
ClientGetRemoteDevName
ClientGetRemoteDevNetSettings
ClientGetRemoteDevValueByName
ClientGetSessionIds
ClientGetStateRemoteDev
ClientGetStateSharedDevice
ClientIsIsolationAvailable
ClientRemoteDevDisconnect
ClientRemoteDevRequiresAuth
ClientRemoteDisconnectIsEnabled
ClientRemoveEnumOfRemoteDev
ClientRemoveRemoteDev
ClientSetRdpAutoconnect
ClientSetRdpIsolation
ClientStartRemoteDev
ClientStartRemoteDevIsolateSession
ClientStartRemoteDevIsolateUser
ClientStopRemoteDev
ClientTrafficRemoteDevIsCompressed
ClientTrafficRemoteDevIsEncrypted
LicenseActivate
LicenseGetInfoValueByName
LicenseIsOk
LicenseRegister
ServerAllowDevRemoteDisconnect
ServerCreateEnumUsbDev
ServerDisconnectRemoteDev
ServerGetLastError
ServerGetSharedUsbDevIsCompressed
ServerGetSharedUsbDevIsCrypt
ServerGetSharedUsbDevNetSettings
ServerGetSharedUsbDevRequiresAuth
ServerGetUsbDevClassCode
ServerGetUsbDevFromHub
ServerGetUsbDevName
ServerGetUsbDevNameEx
ServerGetUsbDevStatus
ServerGetUsbDevValueByName
ServerRemoveEnumUsbDev
ServerSetDevUserDescription
ServerSetNoReset
ServerSetSharedUsbDevAuth
ServerSetSharedUsbDevCompress
ServerSetSharedUsbDevCrypt
ServerSetUsbDevValueByName
ServerShareUsbDev
ServerShareUsbDev2
ServerShareUsbWithPredefinedValues
ServerUnshareAllUsbDev
ServerUnshareUsbDev
ServerUsbDevIsConnected
ServerUsbDevIsHub
ServerUsbDevIsShared
SetCallBackOnChangeDevList
SetCallBackOnLicenseStatusChange
UpdateUsbTree

Sections

.text
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

08833e753de2709e4b619a59efe79a1c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

Exports

Exports

Sections

.text Size: 46KB - Virtual size: 46KB

.rdata Size: 26KB - Virtual size: 26KB

.data Size: 2KB - Virtual size: 4KB

.rsrc Size: 512B - Virtual size: 248B

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 46KB - Virtual size: 46KB

.rdata
Size: 26KB - Virtual size: 26KB

.data
Size: 2KB - Virtual size: 4KB

.rsrc
Size: 512B - Virtual size: 248B

.reloc
Size: 4KB - Virtual size: 3KB