0982d2c44474ffb54ca6a03d171d6e8381db3b211896cd35d43888c7954e445c

Sharing

Copy URL Twitter E-mail

General

Target

0982d2c44474ffb54ca6a03d171d6e8381db3b211896cd35d43888c7954e445c
Size

983KB
MD5

a5d296af519b867f8b9b63d5da74cafb
SHA1

f8df7c29d850e89605a2b8cbb063618489514ec1
SHA256

0982d2c44474ffb54ca6a03d171d6e8381db3b211896cd35d43888c7954e445c
SHA512

a6b4d1704fa69746fdb21f0a84de78ce7325cf9184b35ce87ab74a8335ba825adfbab7498e9dffeb5f0910e0a01ba35fda4ced5532426e3c0afb73c229db0ec9
SSDEEP

24576:VOQ0ublCZd3J24F0flJdOxCAskTTxyr868qaE+H4DRNGPPBnCqpnzzf:IQNblCv3ZmSqEyrSvH4XGQqpnzr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0982d2c44474ffb54ca6a03d171d6e8381db3b211896cd35d43888c7954e445c

Files

0982d2c44474ffb54ca6a03d171d6e8381db3b211896cd35d43888c7954e445c
.exe windows:5 windows x86 arch:x86

77fb2533c9105c56fddcb2ac578ac25d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\svn\SVClient\020\sv3.0-client\PF\PF_Client\Release\PF_CLIENT.pdb

Imports

ws2_32

bind
__WSAFDIsSet
connect
accept
htons
ntohs
socket
closesocket
ntohl
listen
WSAGetLastError
shutdown
WSASetLastError
WSAEnumNetworkEvents
WSAEventSelect
recv
gethostbyname
getsockname
send
htonl
WSACleanup
ioctlsocket
sendto
inet_ntoa
WSAStartup
recvfrom
select
inet_addr

user32

SendMessageA
GetUserObjectInformationW
GetProcessWindowStation
GetDesktopWindow
MessageBoxA
FindWindowA

advapi32

RegisterEventSourceA
DeregisterEventSource
ReportEventA
CryptDecrypt
CryptDestroyKey
CryptEncrypt
CryptImportKey
CryptAcquireContextA
CryptReleaseContext
GetSecurityDescriptorSacl
SetSecurityInfo
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor

shell32

SHGetPathFromIDListA
SHGetSpecialFolderLocation

winmm

timeGetTime

kernel32

CompareStringA
SetEndOfFile
CompareStringW
SetEnvironmentVariableA
CreateFileW
GlobalMemoryStatus
GetVersionExA
FlushConsoleInputBuffer
GetDriveTypeA
ReadConsoleInputA
SetConsoleMode
GetFullPathNameA
GetFileInformationByHandle
GetTimeZoneInformation
FlushFileBuffers
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
GetLocalTime
SetEvent
Sleep
GetLastError
PeekNamedPipe
CloseHandle
CreateEventA
WaitForSingleObject
InitializeCriticalSection
LeaveCriticalSection
FindFirstFileA
EnterCriticalSection
FindClose
ResetEvent
FindNextFileA
DeleteCriticalSection
DeleteFileA
MapViewOfFile
UnmapViewOfFile
HeapFree
GetProcessHeap
WideCharToMultiByte
OpenMutexA
CreateFileMappingA
CreateMutexA
OutputDebugStringA
ReleaseMutex
GetVersion
OpenFileMappingA
LocalFree
FreeLibrary
GetCurrentProcess
GetProcAddress
LoadLibraryA
GetModuleHandleA
CreateFileA
DeviceIoControl
WaitForMultipleObjects
CreateDirectoryA
WriteConsoleA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
InitializeCriticalSectionAndSpinCount
SetConsoleCtrlHandler
HeapSize
ReadFile
GetCurrentDirectoryA
OpenEventA
GetCommandLineA
ExitThread
ResumeThread
CreateThread
GetSystemTimeAsFileTime
HeapAlloc
FileTimeToSystemTime
FileTimeToLocalFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
RtlUnwind
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
HeapReAlloc
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetConsoleCP
GetConsoleMode
SetFilePointer

topcap

pcap_open
pcap_sendpacket
pcap_close
pcap_freealldevs
pcap_findalldevs

toppack

PacketOpenAdapter
PacketCloseAdapter
PacketRequest

Sections

.text
Size: 712KB - Virtual size: 712KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 231KB - Virtual size: 230KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 38KB - Virtual size: 14.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

77fb2533c9105c56fddcb2ac578ac25d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

user32

advapi32

shell32

winmm

kernel32

topcap

toppack

Sections

.text Size: 712KB - Virtual size: 712KB

.rdata Size: 231KB - Virtual size: 230KB

.data Size: 38KB - Virtual size: 14.3MB

.rsrc Size: 512B - Virtual size: 436B

.text
Size: 712KB - Virtual size: 712KB

.rdata
Size: 231KB - Virtual size: 230KB

.data
Size: 38KB - Virtual size: 14.3MB

.rsrc
Size: 512B - Virtual size: 436B