ab1fe27d41dbbb82c536d9eca1eb357bf7f2b057e02eacbc56f360722147d84d

Sharing

Copy URL

Twitter E-mail

General

Target

ab1fe27d41dbbb82c536d9eca1eb357bf7f2b057e02eacbc56f360722147d84d
Size

183KB
MD5

76414086b1a5652b1e01b9723ef3658f
SHA1

c19af239cdcd03dff2176ea7b539a070e3e6e5e5
SHA256

ab1fe27d41dbbb82c536d9eca1eb357bf7f2b057e02eacbc56f360722147d84d
SHA512

156861515ac968c511e1cc357256ea2b449c4f361a15150d13d553b0471dcf23c876ce15d212c6bade90b5319325021e2f9b52de2cb6cc5cb542be6ecd29f2e9
SSDEEP

3072:ir0cGQ5NNRZa1PwUtdGbegMaZvEVQ4w92Gvx/Tm0cRNYIaXoYWulWQ35Jr4VfJSv:HcG8zaFRG0i5iG3EJJGPLuOu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ab1fe27d41dbbb82c536d9eca1eb357bf7f2b057e02eacbc56f360722147d84d

Files

ab1fe27d41dbbb82c536d9eca1eb357bf7f2b057e02eacbc56f360722147d84d
.exe windows:5 windows x86 arch:x86

536f7ebfc55a698f528f23d3c24c7bf5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

llcommon

??0LLAPRPool@@QAE@AAV0@@Z
??1LLFastTimer@@QAE@XZ
?sCurTimerData@LLFastTimer@@2UCurTimerData@1@A
?getCPUClockCount32@LLFastTimer@@CAIXZ
??0LLSD@@QAE@ABV0@@Z
?assign@LLSD@@QAEXPBD@Z
??0DeclareTimer@LLFastTimer@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??1DeclareTimer@LLFastTimer@@UAE@XZ
??0LLRunnable@@QAE@XZ
??1LLRunnable@@UAE@XZ
?ll_safe_string@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBD@Z
?start@LLFrameTimer@@QAEXM@Z
?setExpiryAt@LLFrameTimer@@QAEXN@Z
?expiresAt@LLFrameTimer@@QBENXZ
?addRunnable@LLRunner@@QAE_JV?$shared_ptr@VLLRunnable@@@boost@@W4ERunSchedule@1@N@Z
??0LLFrameTimer@@QAE@XZ
??1LLRunner@@QAE@XZ
??0LLRunner@@QAE@XZ
?hasExpired@LLFrameTimer@@QBE_NXZ
?run@LLRunner@@QAEHXZ
?toUpper@LLStringOps@@SADD@Z
?ll_apr_warn_status@@YA_NH@Z
??0LLSD@@QAE@XZ
?assign@LLSD@@QAEXABV1@@Z
??ALLSD@@QAEAAV0@PBD@Z
?emptyMap@LLSD@@SA?AV1@XZ
?assign@LLSD@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??ALLSD@@QAEAAV0@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?assign@LLSD@@QAEXH@Z
?assign@LLSD@@QAEX_N@Z
?assign@LLSD@@QAEXN@Z
?has@LLSD@@QBE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??ALLSD@@QBEABV0@PBD@Z
??ALLSD@@QBEABV0@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?asInteger@LLSD@@QBEHXZ
?asBoolean@LLSD@@QBE_NXZ
?asReal@LLSD@@QBENXZ
?asString@LLSD@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?llstrtou64@@YA_KPBDPAPADH@Z
?fromXML@LLSDSerialize@@SAHAAVLLSD@@AAV?$basic_istream@DU?$char_traits@D@std@@@std@@_N@Z
??BLLSD@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?create@LLAPRPool@@QAEXAAV1@@Z
?llformat@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBDZZ
?toPrettyXML@LLSDSerialize@@SAHABVLLSD@@AAV?$basic_ostream@DU?$char_traits@D@std@@@std@@@Z
?lock@LLMutex@@QAEXPAVDeclareTimer@LLFastTimer@@@Z
??1LLMutexImpl@@EAE@XZ
??_7LLMutex@@6B@
?tldata@LLThreadLocalData@@SAAAV1@XZ
??0LLMutex@@QAE@AAVLLAPRPool@@@Z
??1LLMutex@@UAE@XZ
?unlock@LLMutex@@QAEXXZ
?lock@LLMutexLock@@AAEXXZ
?destroy@LLAPRPool@@QAEXXZ
??0LLAPRPool@@QAE@XZ
??1LLAPRPool@@QAE@XZ
?get@LLAPRRootPool@@SAAAV1@XZ
??1LLSD@@QAE@XZ
??0LLSD@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?ms_sleep@@YAXI@Z
?setTimerExpirySec@LLTimer@@QAEXM@Z
?hasExpired@LLTimer@@QBEHXZ
??1CallSite@LLError@@QAE@XZ
?initForApplication@LLError@@YAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N@Z
?setDefaultLevel@LLError@@YAXW4ELevel@1@@Z
??0LLTimer@@QAE@XZ
?reset@LLTimer@@QAEXXZ
?getElapsedTimeF64@LLTimer@@QBENXZ
??1LLTimer@@QAE@XZ
??0CallSite@LLError@@QAE@W4ELevel@1@PBDHABVtype_info@@1_NPAPBDI@Z
?shouldLog@Log@LLError@@SA_NAAUCallSite@2@@Z
?out@Log@LLError@@SAPAV?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?flush@Log@LLError@@SAXPAV?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABUCallSite@2@@Z

wsock32

gethostbyname
gethostbyaddr
WSAStartup
socket
htonl
bind
getsockname
inet_ntoa
setsockopt
getsockopt
htons
sendto
recvfrom
WSAGetLastError
ioctlsocket
shutdown
closesocket
WSACleanup
inet_addr
ntohs

libapr-1

_apr_dso_unload@4
_apr_dso_error@12
_apr_dso_load@12
_apr_socket_timeout_set@12
_apr_socket_opt_set@12
_apr_socket_recv@12
_apr_socket_send@12
_apr_socket_close@4
_apr_socket_listen@8
_apr_socket_bind@8
_apr_sockaddr_info_get@24
_apr_socket_create@20
_apr_socket_accept@12
_apr_socket_connect@8
_apr_strerror@12
_apr_sockaddr_ip_get@8
_apr_socket_addr_get@12
_apr_pollset_add@8
_apr_pollset_create@16
_apr_pollset_destroy@4
_apr_pollset_poll@20
_apr_dso_sym@12

msvcp100

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??1_Container_base12@std@@QAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAI@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
??_7ios_base@std@@6B@
?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_BADOFF@std@@3_JB
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z

msvcr100

_controlfp_s
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??3@YAXPAX@Z
memcpy
memmove
??2@YAPAXI@Z
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
__CxxFrameHandler3
isspace
??_V@YAXPAX@Z
_purecall
exit
_chdir
memchr
memset
strtoul
strncpy
strncmp
printf
_invoke_watson
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__set_app_type
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
atol
??0exception@std@@QAE@ABQBD@Z

kernel32

IsProcessorFeaturePresent
GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoW
HeapSetInformation
InterlockedCompareExchange
Sleep
InterlockedExchange
DecodePointer
EncodePointer
CreateFileMappingA
GetCurrentProcessId
OpenFileMappingA
MapViewOfFile
GetLastError
CloseHandle
UnmapViewOfFile
SetUnhandledExceptionFilter
LoadLibraryW
GetProcAddress
VirtualProtect

Sections

.text
Size: 138KB - Virtual size: 138KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

536f7ebfc55a698f528f23d3c24c7bf5

Headers

DLL Characteristics

File Characteristics

Imports

llcommon

wsock32

libapr-1

msvcp100

msvcr100

kernel32

Sections

.text Size: 138KB - Virtual size: 138KB

.rdata Size: 30KB - Virtual size: 29KB

.data Size: 2KB - Virtual size: 13KB

.reloc Size: 11KB - Virtual size: 10KB

.text
Size: 138KB - Virtual size: 138KB

.rdata
Size: 30KB - Virtual size: 29KB

.data
Size: 2KB - Virtual size: 13KB

.reloc
Size: 11KB - Virtual size: 10KB