572fa6d5ea4fd2a8e6407683b13988f2c5beeed52af477c5903797817fb4c273

Sharing

Copy URL Twitter E-mail

General

Target

572fa6d5ea4fd2a8e6407683b13988f2c5beeed52af477c5903797817fb4c273
Size

1.7MB
MD5

e7447fc0653f15e0ba7ba02d40c77e5c
SHA1

f7161a1fa98532740329e613044d99b852939954
SHA256

572fa6d5ea4fd2a8e6407683b13988f2c5beeed52af477c5903797817fb4c273
SHA512

ba937beaa5bf83c90739c7c41520b94956fa9aeb5de855ffe71e312c7a62a058c25277a5e8d575b1d68cc9ac0854d1e02525775b4f8a5310cfa6008201662152
SSDEEP

49152:VShsB9MNqP4QoCAhOp70dVzloX/Udtvb:24Yype

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
572fa6d5ea4fd2a8e6407683b13988f2c5beeed52af477c5903797817fb4c273

Files

572fa6d5ea4fd2a8e6407683b13988f2c5beeed52af477c5903797817fb4c273
.dll windows:4 windows x86 arch:x86

62efcd2f9902382a32aeb8363a501047

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ippcap

pcap_next
pcap_geterr
pcap_fileno
pcap_compile
pcap_setfilter
pcap_datalink
pcap_open_live
pcap_setbuff
pcap_read
pcap_lookupdev
pcap_close

kernel32

FindNextFileA
FindFirstFileA
DeleteFileW
QueryPerformanceFrequency
InitializeCriticalSection
WaitForSingleObject
LeaveCriticalSection
EnterCriticalSection
MoveFileA
GetFileAttributesA
MultiByteToWideChar
WideCharToMultiByte
GetCurrentThreadId
GetModuleHandleA
GetFileInformationByHandle
CreateThread
GetCurrentProcess
OpenProcess
LocalFree
FindNextFileW
FindFirstFileW
GetSystemInfo
lstrcmpA
SetFileAttributesA
Sleep
CreateDirectoryA
GetComputerNameA
GetVersionExA
WriteFile
SetFilePointer
CompareFileTime
CreateEventA
GetProfileStringA
CreateFileW
FreeConsole
WriteConsoleA
GetStdHandle
AllocConsole
DisableThreadLibraryCalls
SetLastError
lstrcpynA
GetModuleFileNameA
LocalAlloc
TlsAlloc
DeleteCriticalSection
GlobalFree
GlobalUnlock
GlobalHandle
TlsFree
GlobalLock
GlobalReAlloc
GlobalAlloc
TlsSetValue
LocalReAlloc
TlsGetValue
lstrlenA
GetVersion
InterlockedIncrement
SetEvent
ResumeThread
SetThreadPriority
SuspendThread
lstrcpyA
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
lstrcmpiA
GlobalGetAtomNameA
lstrcatA
LockResource
LoadResource
FindResourceA
GetProcessVersion
MulDiv
GlobalFlags
GetCurrentThread
GetCPInfo
GetOEMCP
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetCurrentDirectoryA
SetErrorMode
FindClose
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetVolumeInformationA
GetFullPathNameA
GetStringTypeExA
GetThreadLocale
GetShortPathNameA
LocalFileTimeToFileTime
SystemTimeToFileTime
SetFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
RtlUnwind
HeapFree
HeapAlloc
GetFileType
GetTimeZoneInformation
GetSystemTime
HeapReAlloc
RaiseException
GetCommandLineA
ExitThread
HeapSize
ExitProcess
TerminateProcess
FatalAppExitA
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
LCMapStringA
LCMapStringW
SetStdHandle
SetHandleCount
GetStartupInfoA
SetUnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
UnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
SetConsoleCtrlHandler
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetLocaleInfoW
GetExitCodeThread
FormatMessageA
FindResourceExA
FormatMessageW
SleepEx
InterlockedExchange
CreateSemaphoreA
ReleaseSemaphore
CreateMutexA
ReleaseMutex
PulseEvent
ResetEvent
WaitForMultipleObjects
TerminateThread
GetModuleHandleW
LoadLibraryW
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
GetCurrentDirectoryW
GetTempPathA
GetTempPathW
GetEnvironmentVariableW
SetFileAttributesW
GetFileAttributesW
MoveFileW
CreateDirectoryW
CopyFileW
RemoveDirectoryW
MoveFileExA
GetACP
MoveFileExW
QueryPerformanceCounter
CopyFileA
lstrlenW
DeleteFileA
InterlockedDecrement
OutputDebugStringW
OutputDebugStringA
RemoveDirectoryA
CreateFileA
GetFileTime
GetFileSize
ReadFile
CloseHandle
GetCurrentProcessId
GetTickCount
GetLocalTime
FreeLibrary
LoadLibraryA
GetLastError
GetProcAddress
GetModuleFileNameW
GetCommandLineW
GetWindowsDirectoryW
GetWindowsDirectoryA
GetSystemDirectoryW
GetSystemDirectoryA
DefineDosDeviceA
GetDiskFreeSpaceExA
SetVolumeLabelA
QueryDosDeviceW
GetSystemTimeAsFileTime
DuplicateHandle
QueryDosDeviceA
GetLogicalDrives
GetDriveTypeW
GetDriveTypeA
SetNamedPipeHandleState
WaitNamedPipeA
ConnectNamedPipe
CreateNamedPipeA
GetOverlappedResult
CancelIo
OpenEventA
OpenMutexA
OpenSemaphoreA
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
OpenFileMappingA
SizeofResource
EnumResourceLanguagesA
LoadLibraryExA
LoadLibraryExW
GetComputerNameW
SetThreadLocale

advapi32

RegisterEventSourceA
ReportEventA
DeregisterEventSource
LookupAccountSidW
InitializeSecurityDescriptor
GetLengthSid
InitializeAcl
AddAccessAllowedAce
GetAce
SetSecurityDescriptorDacl
LookupAccountNameW
RegSetValueExW
RegCreateKeyW
RegEnumValueA
RegQueryInfoKeyA
RegEnumKeyA
RegConnectRegistryA
RegDeleteKeyA
RegDeleteValueA
RegOpenKeyExA
RegCreateKeyExA
RegNotifyChangeKeyValue
SetFileSecurityA
RegSetValueExA
RegOpenKeyA
GetUserNameA
GetTokenInformation
LookupAccountSidA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegCreateKeyA
RegQueryValueExA
RegOpenKeyExW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyW
RegCloseKey

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

comctl32

ord17

rpcrt4

UuidCreate
UuidToStringW
RpcStringFreeW

Exports

Exports

CheckLeaveEmailData
DealEmailData
GetSmbLog
Mail_SSLRegisterCallBack
MoveEMailRecordTempLocation
RunDll32
SetLocalIPs
SetLogFlag
SetLogMode
SetSmbLogFlag
SetSyncTime
SetUserName
StartMonitor
StopMonitor
ToCheckMailHistoryFile
ToCheckMailHistoryPath
ToStartMailDataRegMonitor

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 160KB - Virtual size: 156KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 136KB - Virtual size: 176KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 92KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

62efcd2f9902382a32aeb8363a501047

Headers

File Characteristics

Imports

ippcap

kernel32

advapi32

winspool.drv

comctl32

rpcrt4

Exports

Exports

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 160KB - Virtual size: 156KB

.data Size: 136KB - Virtual size: 176KB

.rsrc Size: 8KB - Virtual size: 7KB

.reloc Size: 92KB - Virtual size: 89KB

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 160KB - Virtual size: 156KB

.data
Size: 136KB - Virtual size: 176KB

.rsrc
Size: 8KB - Virtual size: 7KB

.reloc
Size: 92KB - Virtual size: 89KB