195235c85171de9fd3891550e5658c9960453b6f209fd5b44ecf694aad450766

Sharing

Copy URL Twitter E-mail

General

Target

195235c85171de9fd3891550e5658c9960453b6f209fd5b44ecf694aad450766
Size

2.5MB
MD5

77426117b23f052076cae8ba3b60fdc2
SHA1

a5486a178f6681a36f48691ff9f0a2949ff6e6c7
SHA256

195235c85171de9fd3891550e5658c9960453b6f209fd5b44ecf694aad450766
SHA512

6ae08160f927edcd0fd8ab0d38dbfe9e600a781e78beba5ec585b721a78be35a9f31f96d74a4eb005cf1de85a5e0579268cf9052db1026403841c21854fb4724
SSDEEP

49152:u+wurnSifI+0Zs35SOZv64PWTcCJ+6ynhPj+VDtIy:unurnSin0Zs35PZv64PWwhj+VDtIy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
195235c85171de9fd3891550e5658c9960453b6f209fd5b44ecf694aad450766

Files

195235c85171de9fd3891550e5658c9960453b6f209fd5b44ecf694aad450766
.dll windows:4 windows x64 arch:x64

9bceeb32b90b5d481855cc7f164cc78b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

advapi32

RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegQueryValueExW

libgmp-10

__gmpz_clear

libgnutls-30

gnutls_alert_get
gnutls_alert_get_name
gnutls_calloc
gnutls_certificate_allocate_credentials
gnutls_certificate_free_credentials
gnutls_certificate_get_issuer
gnutls_certificate_get_peers
gnutls_certificate_set_key
gnutls_certificate_set_verify_function
gnutls_certificate_set_x509_crl
gnutls_certificate_set_x509_system_trust
gnutls_certificate_set_x509_trust_file
gnutls_certificate_verify_peers2
gnutls_check_version
gnutls_cipher_decrypt
gnutls_cipher_deinit
gnutls_cipher_encrypt
gnutls_cipher_get_block_size
gnutls_cipher_get_id
gnutls_cipher_get_key_size
gnutls_cipher_init
gnutls_cipher_set_iv
gnutls_cipher_suite_info
gnutls_cipher_tag
gnutls_credentials_set
gnutls_deinit
gnutls_dtls_get_data_mtu
gnutls_dtls_get_timeout
gnutls_dtls_set_data_mtu
gnutls_dtls_set_mtu
gnutls_ecc_curve_get_pk
gnutls_error_is_fatal
gnutls_fingerprint
gnutls_free
gnutls_global_init
gnutls_handshake
gnutls_handshake_set_hook_function
gnutls_handshake_set_timeout
gnutls_hash
gnutls_hash_deinit
gnutls_hash_init
gnutls_hkdf_expand
gnutls_hkdf_extract
gnutls_hmac
gnutls_hmac_deinit
gnutls_hmac_fast
gnutls_hmac_get_len
gnutls_hmac_init
gnutls_hmac_output
gnutls_init
gnutls_malloc
gnutls_pcert_deinit
gnutls_pcert_import_x509
gnutls_pem_base64_decode2
gnutls_pk_to_sign
gnutls_pkcs11_get_raw_issuer
gnutls_pkcs11_obj_deinit
gnutls_pkcs11_obj_get_info
gnutls_pkcs11_obj_import_url
gnutls_pkcs11_obj_init
gnutls_pkcs11_privkey_deinit
gnutls_pkcs11_privkey_import_url
gnutls_pkcs11_privkey_init
gnutls_pkcs11_privkey_set_pin_function
gnutls_pkcs12_deinit
gnutls_pkcs12_import
gnutls_pkcs12_init
gnutls_pkcs12_simple_parse
gnutls_pkcs12_verify_mac
gnutls_pkcs7_deinit
gnutls_pkcs7_export2
gnutls_pkcs7_init
gnutls_pkcs7_set_crt
gnutls_prf
gnutls_priority_deinit
gnutls_priority_get_cipher_suite_index
gnutls_priority_init
gnutls_priority_set_direct
gnutls_privkey_deinit
gnutls_privkey_export_ecc_raw
gnutls_privkey_export_x509
gnutls_privkey_generate
gnutls_privkey_get_pk_algorithm
gnutls_privkey_import_pkcs11
gnutls_privkey_import_url
gnutls_privkey_import_x509
gnutls_privkey_import_x509_raw
gnutls_privkey_init
gnutls_privkey_set_pin_function
gnutls_privkey_sign_data
gnutls_privkey_sign_data2
gnutls_psk_allocate_client_credentials
gnutls_psk_free_client_credentials
gnutls_psk_set_client_credentials
gnutls_pubkey_deinit
gnutls_pubkey_export2
gnutls_pubkey_export_ecc_raw
gnutls_pubkey_import
gnutls_pubkey_import_privkey
gnutls_pubkey_import_x509
gnutls_pubkey_init
gnutls_pubkey_verify_data2
gnutls_realloc
gnutls_record_disable_padding
gnutls_record_get_direction
gnutls_record_recv
gnutls_record_send
gnutls_rnd
gnutls_server_name_set
gnutls_session_get_desc
gnutls_session_get_ptr
gnutls_session_is_resumed
gnutls_session_set_id
gnutls_session_set_premaster
gnutls_session_set_ptr
gnutls_strerror
gnutls_transport_get_ptr
gnutls_transport_set_ptr
gnutls_transport_set_pull_function
gnutls_transport_set_pull_timeout_function
gnutls_transport_set_push_function
gnutls_url_is_supported
gnutls_x509_crl_deinit
gnutls_x509_crt_check_hostname
gnutls_x509_crt_check_issuer
gnutls_x509_crt_deinit
gnutls_x509_crt_export
gnutls_x509_crt_export2
gnutls_x509_crt_get_dn
gnutls_x509_crt_get_dn_by_oid
gnutls_x509_crt_get_expiration_time
gnutls_x509_crt_get_fingerprint
gnutls_x509_crt_get_key_id
gnutls_x509_crt_get_key_purpose_oid
gnutls_x509_crt_get_key_usage
gnutls_x509_crt_get_pk_algorithm
gnutls_x509_crt_get_subject_alt_name
gnutls_x509_crt_import
gnutls_x509_crt_import_url
gnutls_x509_crt_init
gnutls_x509_crt_list_import
gnutls_x509_crt_print
gnutls_x509_crt_set_pin_function
gnutls_x509_privkey_deinit
gnutls_x509_privkey_export2
gnutls_x509_privkey_get_key_id
gnutls_x509_privkey_import
gnutls_x509_privkey_import_pkcs8
gnutls_x509_privkey_init

libhogweed-6

nettle_ecc_point_clear
nettle_ecc_point_get
nettle_ecc_point_init
nettle_ecc_point_mul
nettle_ecc_point_set
nettle_ecc_scalar_clear
nettle_ecc_scalar_init
nettle_ecc_scalar_set
nettle_get_secp_256r1
nettle_mpz_get_str_256
nettle_mpz_init_set_str_256_u

libintl-8

__printf__
libintl_asprintf
libintl_bindtextdomain
libintl_dgettext
libintl_fprintf
libintl_snprintf
libintl_sprintf
libintl_vsnprintf

iphlpapi

DeleteUnicastIpAddressEntry
FreeMibTable
GetAdapterIndex
GetAdaptersAddresses
GetAdaptersInfo
GetUnicastIpAddressTable

kernel32

CloseHandle
CreateEventA
CreateFileA
CreateProcessW
DeleteCriticalSection
DeleteFileA
DeviceIoControl
EnterCriticalSection
FormatMessageW
FreeLibrary
GetConsoleWindow
GetCurrentProcessId
GetExitCodeProcess
GetLastError
GetModuleHandleA
GetModuleHandleW
GetOverlappedResult
GetProcAddress
GetSystemTimeAsFileTime
GetTempPathA
GetTimeZoneInformation
GetWindowsDirectoryA
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
LocalFree
MultiByteToWideChar
QueryPerformanceCounter
ReadFile
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteFile

liblz4

LZ4_compress_default
LZ4_decompress_safe

msvcrt

___lc_codepage_func
___mb_cur_max_func
__iob_func
__setusermatherr
_amsg_exit
_close
_errno
_fdopen
_fstat64
_get_osfhandle
_getpid
_gmtime64
_initterm
_localtime64
_lock
_putenv_s
_read
_strdup
_stricmp
_stricmp
_strnicmp
_strtoi64
_strtoui64
_time64
_unlink
_unlock
_wenviron
_wgetenv
_wopen
abort
atoi
atol
calloc
fgets
fputc
free
fwrite
getc
getenv_s
isalnum
isprint
isspace
isxdigit
ldexp
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
realloc
strchr
strcmp
strcpy
strerror
strftime
strlen
strncmp
strncpy
strrchr
strstr
strtol
strtoul
tolower
toupper
ungetc
vfprintf
wcscmp
wcslen
wcsncmp

libp11-kit-0

p11_kit_uri_clear_attribute
p11_kit_uri_format
p11_kit_uri_free
p11_kit_uri_get_attribute
p11_kit_uri_get_token_info
p11_kit_uri_new
p11_kit_uri_parse
p11_kit_uri_set_attribute

secur32

AcquireCredentialsHandleW
DecryptMessage
DeleteSecurityContext
EncryptMessage
FreeContextBuffer
FreeCredentialsHandle
InitializeSecurityContextW
QueryContextAttributesA

shell32

ShellExecuteA

libstoken-1

stoken_check_pin
stoken_compute_tokencode
stoken_decrypt_seed
stoken_destroy
stoken_devid_required
stoken_get_info
stoken_import_rcfile
stoken_import_string
stoken_new
stoken_pass_required
stoken_pin_required

winscard

SCardBeginTransaction
SCardConnectW
SCardDisconnect
SCardEndTransaction
SCardEstablishContext
SCardListReadersW
SCardReleaseContext
SCardTransmit
g_rgSCardT1Pci

ws2_32

WSAEventSelect
WSAGetLastError
WSASetLastError
WSASocketA
WSAStartup
WSAStringToAddressA
__WSAFDIsSet
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
getnameinfo
getpeername
getsockname
getsockopt
htonl
htons
inet_addr
inet_ntop
ioctlsocket
listen
ntohl
ntohs
recv
select
send
setsockopt
socket

libxml2-2

DllMain
htmlNodeDumpFileFormat
htmlReadMemory
xmlAddChild
xmlCopyNode
xmlDocDumpMemoryEnc
xmlDocGetRootElement
xmlDocSetRootElement
xmlFirstElementChild
xmlFree
xmlFreeDoc
xmlFreeNode
xmlGetProp
xmlNewChild
xmlNewDoc
xmlNewNode
xmlNewProp
xmlNewTextChild
xmlNextElementSibling
xmlNodeGetContent
xmlReadMemory
xmlStrcmp
xmlURIUnescapeString

zlib1

adler32
deflate
deflateBound
deflateEnd
deflateInit2_
inflate
inflateEnd
inflateInit2_

Exports

Exports

openconnect__getline
openconnect__win32_setenv
openconnect__win32_strerror
openconnect_check_peer_cert_hash
openconnect_clear_cookie
openconnect_disable_dtls
openconnect_disable_ipv6
openconnect_fopen_utf8
openconnect_free_cert_info
openconnect_free_peer_cert_chain
openconnect_free_supported_protocols
openconnect_get_auth_expiration
openconnect_get_connect_url
openconnect_get_cookie
openconnect_get_cstp_cipher
openconnect_get_cstp_compression
openconnect_get_dnsname
openconnect_get_dtls_cipher
openconnect_get_dtls_compression
openconnect_get_hostname
openconnect_get_idle_timeout
openconnect_get_ifname
openconnect_get_ip_info
openconnect_get_peer_cert_DER
openconnect_get_peer_cert_chain
openconnect_get_peer_cert_details
openconnect_get_peer_cert_hash
openconnect_get_port
openconnect_get_protocol
openconnect_get_supported_protocols
openconnect_get_tls_library_version
openconnect_get_urlpath
openconnect_get_version
openconnect_has_oath_support
openconnect_has_pkcs11_support
openconnect_has_stoken_support
openconnect_has_system_key_support
openconnect_has_tss2_blob_support
openconnect_has_tss_blob_support
openconnect_has_yubioath_support
openconnect_init_ssl
openconnect_mainloop
openconnect_make_cstp_connection
openconnect_obtain_cookie
openconnect_open_utf8
openconnect_override_getaddrinfo
openconnect_parse_url
openconnect_passphrase_from_fsid
openconnect_read_file
openconnect_reset_ssl
openconnect_set_allow_insecure_crypto
openconnect_set_cafile
openconnect_set_cancel_fd
openconnect_set_cert_expiry_warning
openconnect_set_client_cert
openconnect_set_compression_mode
openconnect_set_cookie
openconnect_set_csd_environ
openconnect_set_dpd
openconnect_set_external_browser_callback
openconnect_set_hostname
openconnect_set_http_auth
openconnect_set_http_proxy
openconnect_set_key_password
openconnect_set_localname
openconnect_set_loglevel
openconnect_set_mca_cert
openconnect_set_mca_key_password
openconnect_set_mobile_info
openconnect_set_option_value
openconnect_set_pass_tos
openconnect_set_pfs
openconnect_set_protect_socket_handler
openconnect_set_protocol
openconnect_set_proxy_auth
openconnect_set_reconnected_handler
openconnect_set_reported_os
openconnect_set_reqmtu
openconnect_set_setup_tun_handler
openconnect_set_sni
openconnect_set_stats_handler
openconnect_set_stoken_mode
openconnect_set_system_trust
openconnect_set_token_callbacks
openconnect_set_token_mode
openconnect_set_trojan_interval
openconnect_set_urlpath
openconnect_set_useragent
openconnect_set_version_string
openconnect_set_webview_callback
openconnect_set_xmlpost
openconnect_set_xmlsha1
openconnect_setup_cmd_pipe
openconnect_setup_csd
openconnect_setup_dtls
openconnect_setup_tun_device
openconnect_setup_tun_fd
openconnect_setup_tun_script
openconnect_sha1
openconnect_version_str
openconnect_vpninfo_free
openconnect_vpninfo_new
openconnect_webview_load_changed

Sections

.text
Size: 360KB - Virtual size: 360KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 668B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/31
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/45
Size: 274KB - Virtual size: 273KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/57
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/70
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/81
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/97
Size: 301KB - Virtual size: 301KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/113
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9bceeb32b90b5d481855cc7f164cc78b

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

libgmp-10

libgnutls-30

libhogweed-6

libintl-8

iphlpapi

kernel32

liblz4

msvcrt

libp11-kit-0

secur32

shell32

libstoken-1

winscard

ws2_32

libxml2-2

zlib1

Exports

Exports

Sections

.text Size: 360KB - Virtual size: 360KB

.data Size: 2KB - Virtual size: 1KB

.rdata Size: 81KB - Virtual size: 81KB

.pdata Size: 7KB - Virtual size: 6KB

.xdata Size: 8KB - Virtual size: 7KB

.bss Size: - Virtual size: 3KB

.edata Size: 4KB - Virtual size: 3KB

.idata Size: 17KB - Virtual size: 16KB

.CRT Size: 512B - Virtual size: 88B

.tls Size: 512B - Virtual size: 16B

.reloc Size: 1024B - Virtual size: 668B

/4 Size: 4KB - Virtual size: 4KB

/19 Size: 1.2MB - Virtual size: 1.2MB

/31 Size: 72KB - Virtual size: 72KB

/45 Size: 274KB - Virtual size: 273KB

/57 Size: 43KB - Virtual size: 42KB

/70 Size: 6KB - Virtual size: 6KB

/81 Size: 38KB - Virtual size: 38KB

/97 Size: 301KB - Virtual size: 301KB

/113 Size: 20KB - Virtual size: 19KB

.text
Size: 360KB - Virtual size: 360KB

.data
Size: 2KB - Virtual size: 1KB

.rdata
Size: 81KB - Virtual size: 81KB

.pdata
Size: 7KB - Virtual size: 6KB

.xdata
Size: 8KB - Virtual size: 7KB

.bss
Size: - Virtual size: 3KB

.edata
Size: 4KB - Virtual size: 3KB

.idata
Size: 17KB - Virtual size: 16KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 16B

.reloc
Size: 1024B - Virtual size: 668B

/4
Size: 4KB - Virtual size: 4KB

/19
Size: 1.2MB - Virtual size: 1.2MB

/31
Size: 72KB - Virtual size: 72KB

/45
Size: 274KB - Virtual size: 273KB

/57
Size: 43KB - Virtual size: 42KB

/70
Size: 6KB - Virtual size: 6KB

/81
Size: 38KB - Virtual size: 38KB

/97
Size: 301KB - Virtual size: 301KB

/113
Size: 20KB - Virtual size: 19KB