57efef2e15c0085c2b9a2877c58c5b059fb5bc8ecbc7f67bcef7e4e5392c2f2f

Sharing

Copy URL Twitter E-mail

General

Target

57efef2e15c0085c2b9a2877c58c5b059fb5bc8ecbc7f67bcef7e4e5392c2f2f
Size

242KB
MD5

2ec123203bdb936308a2e1ae6864a31c
SHA1

e4ea23060051411ba1b9738f4378df93149d25dd
SHA256

57efef2e15c0085c2b9a2877c58c5b059fb5bc8ecbc7f67bcef7e4e5392c2f2f
SHA512

9cbe5d0f307a89e16286fb4dc9c4da030224fdbf0ecc5be80487073ec9da4399cefdd506c6d45275b0560600eaa9fbe8036baf4d237b0bbf817b02a94a173b1c
SSDEEP

3072:Bq5jMXc2XZEhtyz3sf0hYWoI8lk8rtGw7NiuI3ldB95niQeSVM7NJ:QFyE3/Wl+j7N0ldV27N

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
57efef2e15c0085c2b9a2877c58c5b059fb5bc8ecbc7f67bcef7e4e5392c2f2f

Files

57efef2e15c0085c2b9a2877c58c5b059fb5bc8ecbc7f67bcef7e4e5392c2f2f
.dll windows:5 windows x86 arch:x86

89dd7e5aed458335b379fcef5fd61719

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

mswsock.pdb

Imports

advapi32.dll:qodx

ord1

advapi32

GetUserNameA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
RegSetValueExA
SetServiceStatus
DeregisterEventSource
RegNotifyChangeKeyValue
RegCreateKeyExA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
RegisterEventSourceA
ReportEventA
RegDeleteValueW
RegOpenCurrentUser
RegQueryInfoKeyA
RegEnumValueW
OpenSCManagerA
OpenServiceA
StartServiceA
QueryServiceStatus
CloseServiceHandle
RegisterServiceCtrlHandlerA
RevertToSelf

kernel32

LocalAlloc
LocalFree
FormatMessageA
ReadFile
WriteFile
SetConsoleMode
GetConsoleMode
CreateFileA
ExpandEnvironmentStringsA
QueryPerformanceCounter
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
DelayLoadFailureHook
GetComputerNameExA
WriteProcessMemory
GetCurrentThreadId
IsBadWritePtr
IsBadCodePtr
ResetEvent
SwitchToThread
HeapCreate
HeapAlloc
CreateFileMappingA
MapViewOfFile
GetProcessHeap
HeapDestroy
HeapFree
UnmapViewOfFile
VirtualFree
GetSystemInfo
FormatMessageW
lstrcmpW
TerminateThread
CreateEventW
ResumeThread
SetEvent
lstrlenW
lstrcpyW
VirtualAlloc
CreateEventA
WaitForMultipleObjects
MultiByteToWideChar
LCMapStringW
WideCharToMultiByte
GetOverlappedResult
OpenProcess
GetCurrentProcess
DuplicateHandle
IsBadReadPtr
WaitForSingleObject
GetTickCount
InterlockedExchange
CreateThread
InterlockedExchangeAdd
GetCurrentThread
SetThreadPriority
GetCurrentProcessId
FreeLibraryAndExitThread
GetProcAddress
FreeLibrary
InterlockedCompareExchange
LoadLibraryA
GetLastError
Sleep
SetLastError
LeaveCriticalSection
EnterCriticalSection
GetModuleFileNameA
LoadLibraryW
ExpandEnvironmentStringsW
InterlockedDecrement
GetEnvironmentVariableA
CloseHandle
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
PostQueuedCompletionStatus
CreateIoCompletionPort
InterlockedIncrement
SleepEx
OutputDebugStringA

msvcrt

wcscmp
wcscpy
strtoul
_except_handler3
malloc
exit
getc
fopen
_adjust_fdiv
_initterm
free
strncmp
wcsncmp
wcsncpy
wcstol
_wcsnicmp
swprintf
strcpy
strlen
strpbrk
_strnicmp
wcschr
atoi
_stricmp
_wcsicmp
wcslen
wcscat
isspace
fgets
fclose
rewind
_errno
sprintf
_write
_iob
fprintf
isdigit
isxdigit
islower
memmove

ntdll

NtSetIoCompletion
NtRemoveIoCompletion
NtClose
NtSetInformationFile
NtCreateEvent
NtSetInformationObject
NtCreateIoCompletion
RtlFreeHeap
RtlRegisterSecureMemoryCacheCallback
RtlAllocateHeap
DbgPrint
NtOpenKey
RtlInitUnicodeString
RtlQueryRegistryValues
RtlGetNtProductType
NtDeviceIoControlFile
NtCreateFile
NtCancelIoFile
RtlInitializeCriticalSectionAndSpinCount
RtlDeleteCriticalSection
NtSetEvent
RtlRaiseStatus
NtWaitForSingleObject
NtDelayExecution
NtLoadDriver
RtlAdjustPrivilege
RtlImpersonateSelf
NtQuerySystemTime
NtAlertThread
NtQueueApcThread
NtClearEvent
NtReadFile
NtWaitForMultipleObjects
RtlNtStatusToDosError
NtQueryEvent
RtlUnicodeStringToAnsiString
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlFreeAnsiString
RtlDestroyHeap
RtlCreateHeap
RtlDeregisterWaitEx
RtlQueueWorkItem
RtlRegisterWait
NtCreateWaitablePort
NtRequestWaitReplyPort
NtConnectPort
NtReplyPort
RtlIpv6StringToAddressA
RtlIpv6StringToAddressW
RtlInitString
NtQueryValueKey
NtDuplicateObject
NtResetEvent
NtAcceptConnectPort
NtReplyWaitReceivePortEx
NtCompleteConnectPort

rpcrt4

UuidFromStringW
UuidCreate
UuidToStringW
RpcStringFreeW

ws2_32

htons
socket
recv
gethostbyname
inet_addr
select
getsockname
inet_ntoa
WSACleanup
WSAGetLastError
connect
ntohs
accept
listen
send
closesocket
bind
WSAProviderConfigChange
WSAIsBlocking
WSARecv
gethostname
WSCInstallProvider
WSCUpdateProvider
WSCDeinstallProvider
getservbyport
getservbyname
WSAEnumProtocolsW
WSAIoctl
ntohl
htonl
WSCEnumProtocols
WSCGetProviderPath
WSAStartup
WSASocketW

ws2help

WahEnumerateHandleContexts
WahRemoveHandleContext
WahReferenceContextByHandle
WahInsertHandleContext
WahDestroyHandleContextTable
WahCreateHandleContextTable

Exports

Exports

AcceptEx
EnumProtocolsA
EnumProtocolsW
GetAcceptExSockaddrs
GetAddressByNameA
GetAddressByNameW
GetNameByTypeA
GetNameByTypeW
GetServiceA
GetServiceW
GetTypeByNameA
GetTypeByNameW
MigrateWinsockConfiguration
NPLoadNameSpaces
NSPStartup
ServiceMain
SetServiceA
SetServiceW
StartWsdpService
StopWsdpService
SvchostPushServiceGlobals
TransmitFile
WSARecvEx
WSPStartup
dn_expand
getnetbyname
inet_network
rcmd
rexec
rresvport
s_perror
sethostname

Sections

.text
Size: 165KB - Virtual size: 164KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

SANONTCP
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.detour
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

89dd7e5aed458335b379fcef5fd61719

Headers

File Characteristics

PDB Paths

Imports

advapi32.dll:qodx

advapi32

kernel32

msvcrt

ntdll

rpcrt4

ws2_32

ws2help

Exports

Exports

Sections

.text Size: 165KB - Virtual size: 164KB

SANONTCP Size: 47KB - Virtual size: 47KB

.data Size: 3KB - Virtual size: 5KB

.rsrc Size: 6KB - Virtual size: 6KB

.reloc Size: 11KB - Virtual size: 11KB

.detour Size: 7KB - Virtual size: 6KB

.text
Size: 165KB - Virtual size: 164KB

SANONTCP
Size: 47KB - Virtual size: 47KB

.data
Size: 3KB - Virtual size: 5KB

.rsrc
Size: 6KB - Virtual size: 6KB

.reloc
Size: 11KB - Virtual size: 11KB

.detour
Size: 7KB - Virtual size: 6KB