2b9964df3f7ef40746a7119849bc392b8689026e748a25b7450cabe972adf515

Sharing

Copy URL Twitter E-mail

General

Target

2b9964df3f7ef40746a7119849bc392b8689026e748a25b7450cabe972adf515
Size

96KB
MD5

e7025382b0fa03c9c649de29066275d6
SHA1

321c854d5d2928957c05bd993b94ebd67f6f3b0f
SHA256

2b9964df3f7ef40746a7119849bc392b8689026e748a25b7450cabe972adf515
SHA512

e7fccb78f7d8de872a1cf165ce433247c22751df78ad211b55e1681573e3c3da542cfbf02b4df4c9b93bbe43a112dd93ceccc774e74a4e20b8e2a6a3d5de8e31
SSDEEP

1536:RoyweNvtuknT/tO8wAsf0QwVTShIgMbmPkOKoyO:Royw8Vuk+Aw7oS2gs8ZKoyO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2b9964df3f7ef40746a7119849bc392b8689026e748a25b7450cabe972adf515

Files

2b9964df3f7ef40746a7119849bc392b8689026e748a25b7450cabe972adf515
.dll windows:4 windows x86 arch:x86

6b6443ed4de53b63f1ca0862d31d607c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wsock32

closesocket
shutdown
gethostbyname
ioctlsocket
WSAGetLastError
recv
send
inet_addr
gethostname
getpeername
bind
accept
htonl
socket
listen
htons
WSAStartup
connect
WSACleanup

kernel32

HeapReAlloc
InitializeCriticalSection
DeleteCriticalSection
CompareStringW
CompareStringA
SetEnvironmentVariableA
GetTimeZoneInformation
GetUserDefaultLCID
GetLocaleInfoW
GetLocaleInfoA
IsValidCodePage
EnumSystemLocalesA
FlushFileBuffers
LCMapStringW
IsValidLocale
SetStdHandle
LocalFree
FormatMessageA
GetLastError
CreateThread
WaitForSingleObject
CloseHandle
CreateProcessA
DuplicateHandle
GetCurrentProcess
SetCurrentDirectoryA
GetCurrentDirectoryA
Sleep
GetCurrentThreadId
GetThreadLocale
GetVersionExA
GetEnvironmentVariableA
TlsFree
RtlUnwind
GetProcAddress
GetOEMCP
GetACP
GetCPInfo
HeapAlloc
HeapFree
GetCommandLineA
GetVersion
GetModuleHandleA
GetModuleFileNameA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
UnhandledExceptionFilter
IsBadWritePtr
LoadLibraryA
LCMapStringA
EnterCriticalSection
LeaveCriticalSection
ExitProcess
FatalAppExitA
GetStringTypeW
TlsSetValue
TlsAlloc
FreeEnvironmentStringsA
SetLastError
TlsGetValue
GetCurrentThread
TerminateProcess
HeapSize
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
WriteFile
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetFilePointer
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
GetStringTypeA

user32

CharNextA

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

Exports

Exports

Common_SearchThread
GetERRInfo
Manage_CreateProcess
Manage_CreateServerIn
Manage_GetLocale
Manage_GetPlatformInfo
Manage_GetRemoteEnv
Manage_GetToolInfo
Manage_Init
Manage_InitAttachedClientIn
Manage_InitClientIn
Manage_OpenServer
Manage_Read
Manage_Regfunc
Manage_RemoteCall
Manage_Reorganize
Manage_Safety
Manage_SetSocketHandleInfo
Manage_WaitConnect
Packet_Create
Packet_Destroy
Packet_GetBufferSize
Packet_GetSeek
Packet_GetSize
Packet_Map
Packet_Read
Packet_Recycle
Packet_SetSeek
Packet_Unmap
Packet_Write
ReadingByteCheck
Socket_CheckHost
Socket_Close
Socket_GetByteOrder
Socket_GetCodeType
Socket_GetHostIPAddress
Socket_GetPeerName
Socket_GetPlatform
Socket_GetPort
Socket_GetSocketHandle
Socket_Host
Socket_Init
Socket_OpenClient
Socket_OpenServer
Socket_Receive
Socket_Send
Socket_Shutdown
Socket_Talk
Socket_WaitConnect

Sections

.text
Size: 60KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6b6443ed4de53b63f1ca0862d31d607c

Headers

File Characteristics

Imports

wsock32

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 60KB - Virtual size: 58KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 16KB - Virtual size: 19KB

.rsrc Size: 4KB - Virtual size: 808B

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 60KB - Virtual size: 58KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 16KB - Virtual size: 19KB

.rsrc
Size: 4KB - Virtual size: 808B

.reloc
Size: 4KB - Virtual size: 3KB