b573499c02f746355f166d9af30fc960215c365ddce7b15b2bc1eb45088319e3

Sharing

Copy URL Twitter E-mail

General

Target

b573499c02f746355f166d9af30fc960215c365ddce7b15b2bc1eb45088319e3
Size

621KB
MD5

3d7c8c7df0db35e27600744073a87f70
SHA1

f946c0803f9ccc4d1ab016d06a6de24513bfa119
SHA256

b573499c02f746355f166d9af30fc960215c365ddce7b15b2bc1eb45088319e3
SHA512

d86a284948435f51021bcedc505d676de02fda0c5b7c2b7e6f2c9352c0e07b155fcca4b82a5a1149a425230a2ee7ee3f38a9f8d8970a50aa01d9c65ed1c515fd
SSDEEP

12288:zxq1T+wuLPts2mak09NJkpC+jsBNCA1Ukg543V3MZtx:zxyT+wujq2dkIjrIsnDUk6Yq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b573499c02f746355f166d9af30fc960215c365ddce7b15b2bc1eb45088319e3

Files

b573499c02f746355f166d9af30fc960215c365ddce7b15b2bc1eb45088319e3
.exe windows:6 windows x86 arch:x86

b3d13505cdf0a1c34dd6a71810bc1568

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

iphlpapi

GetBestRoute
GetAdaptersInfo

kernel32

InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
CreateThread
GetCurrentThreadId
SetEvent
WaitForSingleObject
CreateEventA
HeapAlloc
HeapFree
GetProcessHeap
GlobalMemoryStatusEx
GetVersionExA
GetSystemTime
GetLocalTime
GetTickCount64
GetHandleInformation
SetLastError
Sleep
GetQueuedCompletionStatusEx
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
InitOnceExecuteOnce
GetModuleHandleW
GetProcAddress
SetFileCompletionNotificationModes
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
CreateMutexA
GetLastError
CloseHandle
CreateIoCompletionPort
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter

advapi32

CryptAcquireContextA
CryptGenRandom
CryptReleaseContext

ws2_32

setsockopt
socket
WSACleanup
WSAGetLastError
sendto
freeaddrinfo
shutdown
WSAStartup
send
recvfrom
recv
listen
getsockopt
getsockname
ioctlsocket
connect
closesocket
bind
getaddrinfo
WSAIoctl
ntohl
htonl
ntohs
gethostname
inet_ntop
inet_pton
accept
htons

vcruntime140

_except_handler4_common
__current_exception_context
__current_exception
memmove
memcmp
memcpy
strstr
strchr
memset

api-ms-win-crt-stdio-l1-1-0

_sopen_s
_set_fmode
_write
_lseek
_close
__stdio_common_vfprintf
__stdio_common_vsprintf
__stdio_common_vsscanf
rewind
__p__commode
ftell
fseek
fread
fopen
fclose
__acrt_iob_func

api-ms-win-crt-heap-l1-1-0

_set_new_mode
realloc
malloc
calloc
free

api-ms-win-crt-runtime-l1-1-0

_c_exit
_errno
strerror
_initialize_onexit_table
_cexit
__p___argv
__p___argc
_exit
_register_onexit_function
_register_thread_local_exe_atexit_callback
abort
strerror_s
_crt_atexit
_initterm_e
_initterm
_get_initial_narrow_environment
_getpid
terminate
_controlfp_s
_seh_filter_exe
_set_app_type
exit
_configure_narrow_argv
_initialize_narrow_environment

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-string-l1-1-0

_strdup
strncpy
strlen
isalpha
strncmp
_strnicmp
strcspn
tolower
strcmp
strnlen
isspace
strncpy_s

api-ms-win-crt-filesystem-l1-1-0

rename
_access
remove

api-ms-win-crt-time-l1-1-0

_gmtime64_s
_mktime64
_time64

api-ms-win-crt-utility-l1-1-0

srand
rand

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Exports

Exports

glc_add_service_mapping
glc_connect
glc_del_service_mapping
glc_reconnect
glc_start
glc_stop
gld_accept
gld_add_service_forward
gld_del_service_forward
gld_start
gld_stop
glp_all_peers_info
glp_configure
glp_configure_v2
glp_connective_report
glp_destroy
glp_exit
glp_get_random_remote
glp_peer_count
glp_peer_info
glp_send_msg
glp_send_msg2
glp_set_license_server
glp_set_netype
glp_set_report_server
glp_set_speed_limit
glp_sip_refresh
glp_sip_state
glp_tunnel_priority
glp_version

Sections

.text
Size: 371KB - Virtual size: 371KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 223KB - Virtual size: 222KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b3d13505cdf0a1c34dd6a71810bc1568

Headers

DLL Characteristics

File Characteristics

Imports

iphlpapi

kernel32

advapi32

ws2_32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: 371KB - Virtual size: 371KB

.rdata Size: 223KB - Virtual size: 222KB

.data Size: 2KB - Virtual size: 61KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 23KB - Virtual size: 22KB

.text
Size: 371KB - Virtual size: 371KB

.rdata
Size: 223KB - Virtual size: 222KB

.data
Size: 2KB - Virtual size: 61KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 23KB - Virtual size: 22KB