0d6dedb313a54fd34ea20da3619f0bacd1eecba6a6da0d2ef67d7375231861fc

Sharing

Copy URL

Twitter E-mail

General

Target

0d6dedb313a54fd34ea20da3619f0bacd1eecba6a6da0d2ef67d7375231861fc
Size

85KB
MD5

cfb49503a814ce8c46486d101ca1d4f2
SHA1

960bb0b36285b73ee8f97884e0d776639b56a330
SHA256

0d6dedb313a54fd34ea20da3619f0bacd1eecba6a6da0d2ef67d7375231861fc
SHA512

bd9ddb2f4d16b1f38e34c5834caac67ddce91dd37bc274c9e5a02f147129b16b26a99d515097508934ef4736dccc39cabf3a17bc6bb114a6ef4b6d9da4e87c24
SSDEEP

1536:YtlUExzFTF4hk7LlNkn1TxGhAzfyjBfQ9StxjuKjjRzS1l7y:Az+kVMTRzuxjjjjRzIl7y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0d6dedb313a54fd34ea20da3619f0bacd1eecba6a6da0d2ef67d7375231861fc

Files

0d6dedb313a54fd34ea20da3619f0bacd1eecba6a6da0d2ef67d7375231861fc
.dll regsvr32 windows:6 windows x86 arch:x86

d6f02e21e81038a98dfab1ece280c946

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\pt\Documents\Visual Studio 2015\Projects\ts3upld\Release\ts3upld.pdb

Imports

aws-cpp-sdk-s3

?SetBucket@PutObjectRequest@Model@S3@Aws@@QAEX$$QAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?WithBucket@GetObjectRequest@Model@S3@Aws@@QAEAAV1234@$$QAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??0PutObjectRequest@Model@S3@Aws@@QAE@XZ
?SetKey@PutObjectRequest@Model@S3@Aws@@QAEX$$QAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??1PutObjectRequest@Model@S3@Aws@@UAE@XZ
??0ListObjectsV2Request@Model@S3@Aws@@QAE@XZ
?ListObjectsV2@S3Client@S3@Aws@@UBE?AV?$Outcome@VListObjectsV2Result@Model@S3@Aws@@V?$AWSError@W4S3Errors@S3@Aws@@@Client@4@@Utils@3@ABVListObjectsV2Request@Model@23@@Z
??1DeleteObjectRequest@Model@S3@Aws@@UAE@XZ
?WithKey@DeleteObjectRequest@Model@S3@Aws@@QAEAAV1234@$$QAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?WithBucket@DeleteObjectRequest@Model@S3@Aws@@QAEAAV1234@$$QAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??0DeleteObjectRequest@Model@S3@Aws@@QAE@XZ
??1GetObjectRequest@Model@S3@Aws@@UAE@XZ
?WithKey@GetObjectRequest@Model@S3@Aws@@QAEAAV1234@$$QAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?WithPrefix@ListObjectsV2Request@Model@S3@Aws@@QAEAAV1234@$$QAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?SetContinuationToken@ListObjectsV2Request@Model@S3@Aws@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??1ListObjectsV2Request@Model@S3@Aws@@UAE@XZ
??0GetObjectRequest@Model@S3@Aws@@QAE@XZ
??1DeleteObjectResult@Model@S3@Aws@@QAE@XZ
?GetObject@S3Client@S3@Aws@@UBE?AV?$Outcome@VGetObjectResult@Model@S3@Aws@@V?$AWSError@W4S3Errors@S3@Aws@@@Client@4@@Utils@3@ABVGetObjectRequest@Model@23@@Z
?DeleteObject@S3Client@S3@Aws@@UBE?AV?$Outcome@VDeleteObjectResult@Model@S3@Aws@@V?$AWSError@W4S3Errors@S3@Aws@@@Client@4@@Utils@3@ABVDeleteObjectRequest@Model@23@@Z
??1S3Client@S3@Aws@@UAE@XZ
??0S3Client@S3@Aws@@QAE@ABVAWSCredentials@Auth@2@ABUClientConfiguration@Client@2@_N2@Z
??1PutObjectResult@Model@S3@Aws@@QAE@XZ
??1ListObjectsV2Result@Model@S3@Aws@@QAE@XZ
??0Object@Model@S3@Aws@@QAE@ABV0123@@Z
??1Object@Model@S3@Aws@@QAE@XZ
??1GetObjectResult@Model@S3@Aws@@QAE@XZ
?WithBucket@ListObjectsV2Request@Model@S3@Aws@@QAEAAV1234@$$QAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

aws-cpp-sdk-core

??0ClientConfiguration@Client@Aws@@QAE@XZ
?SetBody@AmazonStreamingWebServiceRequest@Aws@@QAEXABV?$shared_ptr@V?$basic_iostream@DU?$char_traits@D@std@@@std@@@std@@@Z
??1AWSCredentials@Auth@Aws@@QAE@XZ
?InitAPI@Aws@@YAXABUSDKOptions@1@@Z
?ShutdownAPI@Aws@@YAXABUSDKOptions@1@@Z
??1ClientConfiguration@Client@Aws@@QAE@XZ
??0AWSCredentials@Auth@Aws@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@00@Z

ssh

sftp_new
sftp_free
sftp_init
sftp_opendir
sftp_readdir
sftp_dir_eof
ssh_userauth_password
sftp_attributes_free
sftp_closedir
sftp_close
sftp_open
sftp_file_set_blocking
sftp_read
ssh_options_set
ssh_new
ssh_free
ssh_disconnect
sftp_fstat
ssh_connect

kernel32

SetEvent
IsProcessorFeaturePresent
TerminateProcess
ResetEvent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
WaitForSingleObjectEx
CreateEventW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetCurrentProcess
OutputDebugStringW
SetThreadLocale
GetThreadLocale
LeaveCriticalSection
EnterCriticalSection
EncodePointer
WideCharToMultiByte
MoveFileW
GetTickCount
CloseHandle
WriteFile
DeleteFileW
CreateFileW
MultiByteToWideChar
FindResourceW
lstrcmpiW
SizeofResource
LoadResource
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
FreeLibrary
DeleteCriticalSection
InitializeSListHead
InitializeCriticalSectionEx
GetLastError
RaiseException
DecodePointer

user32

CharNextW

advapi32

RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCloseKey

ole32

StringFromGUID2
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance

oleaut32

VariantClear
VariantInit
RegisterTypeLi
VarBstrCat
SysAllocStringByteLen
SysStringByteLen
UnRegisterTypeLi
SysStringLen
LoadTypeLi
VariantCopy
SysAllocStringLen
SysAllocString
VarUI4FromStr
SysFreeString

msvcp140

?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_BADOFF@std@@3_JB
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
??Bid@locale@std@@QAEIXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ

vcruntime140

__CxxFrameHandler3
memcpy
_CxxThrowException
wcsstr
__std_terminate
__telemetry_main_return_trigger
memset
memmove
__std_exception_copy
__std_exception_destroy
__vcrt_InitializeCriticalSectionEx
__telemetry_main_invoke_trigger
_except_handler4_common
__std_type_info_destroy_list
_purecall

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_invalid_parameter_noinfo
_invalid_parameter_noinfo_noreturn
_initterm
_cexit
_seh_filter_dll
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_errno

api-ms-win-crt-heap-l1-1-0

malloc
_recalloc
free
_callnewh

api-ms-win-crt-string-l1-1-0

wcscat_s
_wcsnicmp
wcscpy_s
wcsncpy_s

api-ms-win-crt-convert-l1-1-0

wcstombs_s

api-ms-win-crt-stdio-l1-1-0

setvbuf
fwrite
_fseeki64
fsetpos
fputc
fgetpos
fgetc
fflush
fclose
_get_stream_buffer_pointers
__stdio_common_vsnwprintf_s
ungetc

api-ms-win-crt-filesystem-l1-1-0

_lock_file
_unlock_file

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d6f02e21e81038a98dfab1ece280c946

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

aws-cpp-sdk-s3

aws-cpp-sdk-core

ssh

kernel32

user32

advapi32

ole32

oleaut32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

Exports

Exports

Sections

.text Size: 48KB - Virtual size: 48KB

.rdata Size: 22KB - Virtual size: 21KB

.data Size: 3KB - Virtual size: 4KB

.gfids Size: 512B - Virtual size: 72B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 5KB - Virtual size: 4KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 48KB - Virtual size: 48KB

.rdata
Size: 22KB - Virtual size: 21KB

.data
Size: 3KB - Virtual size: 4KB

.gfids
Size: 512B - Virtual size: 72B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 5KB - Virtual size: 4KB

.reloc
Size: 4KB - Virtual size: 4KB