2587bf13b960c8cf4dd9888b85c485152c080f91a485900d887c598854b69e47

Sharing

Copy URL Twitter E-mail

General

Target

2587bf13b960c8cf4dd9888b85c485152c080f91a485900d887c598854b69e47
Size

242KB
MD5

6e591e75985aa49b1172ac283d2b63f1
SHA1

1b92c8a8f72b53b5ebfda388d399ca0ed42ab94c
SHA256

2587bf13b960c8cf4dd9888b85c485152c080f91a485900d887c598854b69e47
SHA512

b0516dced956434f8a0d34421c5d2cdf7df0ec47f034fc051cfd2974ee510da1a152ebb4c16fd5c8aae98615b51c7cd8286027817d57a6d62b025fa4e8fb82ea
SSDEEP

3072:Rq5jMXc2XZEhtyz3sf0hYWoI8lk8rtGw7NiuI3ldB95niQeSh7NJ:gFyE3/Wl+j7N0ldVF7N

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2587bf13b960c8cf4dd9888b85c485152c080f91a485900d887c598854b69e47

Files

2587bf13b960c8cf4dd9888b85c485152c080f91a485900d887c598854b69e47
.dll windows:5 windows x86 arch:x86

6f512160133bd9e4a33c1eaf74aaa995

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

mswsock.pdb

Imports

advapi32.dll:mrprxy

ord1

advapi32

GetUserNameA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
RegSetValueExA
SetServiceStatus
DeregisterEventSource
RegNotifyChangeKeyValue
RegCreateKeyExA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
RegisterEventSourceA
ReportEventA
RegDeleteValueW
RegOpenCurrentUser
RegQueryInfoKeyA
RegEnumValueW
OpenSCManagerA
OpenServiceA
StartServiceA
QueryServiceStatus
CloseServiceHandle
RegisterServiceCtrlHandlerA
RevertToSelf

kernel32

LocalAlloc
LocalFree
FormatMessageA
ReadFile
WriteFile
SetConsoleMode
GetConsoleMode
CreateFileA
ExpandEnvironmentStringsA
QueryPerformanceCounter
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
DelayLoadFailureHook
GetComputerNameExA
WriteProcessMemory
GetCurrentThreadId
IsBadWritePtr
IsBadCodePtr
ResetEvent
SwitchToThread
HeapCreate
HeapAlloc
CreateFileMappingA
MapViewOfFile
GetProcessHeap
HeapDestroy
HeapFree
UnmapViewOfFile
VirtualFree
GetSystemInfo
FormatMessageW
lstrcmpW
TerminateThread
CreateEventW
ResumeThread
SetEvent
lstrlenW
lstrcpyW
VirtualAlloc
CreateEventA
WaitForMultipleObjects
MultiByteToWideChar
LCMapStringW
WideCharToMultiByte
GetOverlappedResult
OpenProcess
GetCurrentProcess
DuplicateHandle
IsBadReadPtr
WaitForSingleObject
GetTickCount
InterlockedExchange
CreateThread
InterlockedExchangeAdd
GetCurrentThread
SetThreadPriority
GetCurrentProcessId
FreeLibraryAndExitThread
GetProcAddress
FreeLibrary
InterlockedCompareExchange
LoadLibraryA
GetLastError
Sleep
SetLastError
LeaveCriticalSection
EnterCriticalSection
GetModuleFileNameA
LoadLibraryW
ExpandEnvironmentStringsW
InterlockedDecrement
GetEnvironmentVariableA
CloseHandle
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
PostQueuedCompletionStatus
CreateIoCompletionPort
InterlockedIncrement
SleepEx
OutputDebugStringA

msvcrt

wcscmp
wcscpy
strtoul
_except_handler3
malloc
exit
getc
fopen
_adjust_fdiv
_initterm
free
strncmp
wcsncmp
wcsncpy
wcstol
_wcsnicmp
swprintf
strcpy
strlen
strpbrk
_strnicmp
wcschr
atoi
_stricmp
_wcsicmp
wcslen
wcscat
isspace
fgets
fclose
rewind
_errno
sprintf
_write
_iob
fprintf
isdigit
isxdigit
islower
memmove

ntdll

NtSetIoCompletion
NtRemoveIoCompletion
NtClose
NtSetInformationFile
NtCreateEvent
NtSetInformationObject
NtCreateIoCompletion
RtlFreeHeap
RtlRegisterSecureMemoryCacheCallback
RtlAllocateHeap
DbgPrint
NtOpenKey
RtlInitUnicodeString
RtlQueryRegistryValues
RtlGetNtProductType
NtDeviceIoControlFile
NtCreateFile
NtCancelIoFile
RtlInitializeCriticalSectionAndSpinCount
RtlDeleteCriticalSection
NtSetEvent
RtlRaiseStatus
NtWaitForSingleObject
NtDelayExecution
NtLoadDriver
RtlAdjustPrivilege
RtlImpersonateSelf
NtQuerySystemTime
NtAlertThread
NtQueueApcThread
NtClearEvent
NtReadFile
NtWaitForMultipleObjects
RtlNtStatusToDosError
NtQueryEvent
RtlUnicodeStringToAnsiString
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlFreeAnsiString
RtlDestroyHeap
RtlCreateHeap
RtlDeregisterWaitEx
RtlQueueWorkItem
RtlRegisterWait
NtCreateWaitablePort
NtRequestWaitReplyPort
NtConnectPort
NtReplyPort
RtlIpv6StringToAddressA
RtlIpv6StringToAddressW
RtlInitString
NtQueryValueKey
NtDuplicateObject
NtResetEvent
NtAcceptConnectPort
NtReplyWaitReceivePortEx
NtCompleteConnectPort

rpcrt4

UuidFromStringW
UuidCreate
UuidToStringW
RpcStringFreeW

ws2_32

htons
socket
recv
gethostbyname
inet_addr
select
getsockname
inet_ntoa
WSACleanup
WSAGetLastError
connect
ntohs
accept
listen
send
closesocket
bind
WSAProviderConfigChange
WSAIsBlocking
WSARecv
gethostname
WSCInstallProvider
WSCUpdateProvider
WSCDeinstallProvider
getservbyport
getservbyname
WSAEnumProtocolsW
WSAIoctl
ntohl
htonl
WSCEnumProtocols
WSCGetProviderPath
WSAStartup
WSASocketW

ws2help

WahEnumerateHandleContexts
WahRemoveHandleContext
WahReferenceContextByHandle
WahInsertHandleContext
WahDestroyHandleContextTable
WahCreateHandleContextTable

Exports

Exports

AcceptEx
EnumProtocolsA
EnumProtocolsW
GetAcceptExSockaddrs
GetAddressByNameA
GetAddressByNameW
GetNameByTypeA
GetNameByTypeW
GetServiceA
GetServiceW
GetTypeByNameA
GetTypeByNameW
MigrateWinsockConfiguration
NPLoadNameSpaces
NSPStartup
ServiceMain
SetServiceA
SetServiceW
StartWsdpService
StopWsdpService
SvchostPushServiceGlobals
TransmitFile
WSARecvEx
WSPStartup
dn_expand
getnetbyname
inet_network
rcmd
rexec
rresvport
s_perror
sethostname

Sections

.text
Size: 165KB - Virtual size: 164KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

SANONTCP
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.detour
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6f512160133bd9e4a33c1eaf74aaa995

Headers

File Characteristics

PDB Paths

Imports

advapi32.dll:mrprxy

advapi32

kernel32

msvcrt

ntdll

rpcrt4

ws2_32

ws2help

Exports

Exports

Sections

.text Size: 165KB - Virtual size: 164KB

SANONTCP Size: 47KB - Virtual size: 47KB

.data Size: 3KB - Virtual size: 5KB

.rsrc Size: 6KB - Virtual size: 6KB

.reloc Size: 11KB - Virtual size: 11KB

.detour Size: 7KB - Virtual size: 6KB

.text
Size: 165KB - Virtual size: 164KB

SANONTCP
Size: 47KB - Virtual size: 47KB

.data
Size: 3KB - Virtual size: 5KB

.rsrc
Size: 6KB - Virtual size: 6KB

.reloc
Size: 11KB - Virtual size: 11KB

.detour
Size: 7KB - Virtual size: 6KB