e3bd1defb21887ccef4d8b5cb151a872b040741fd6733780f3162cbb6afe75ba

Sharing

Copy URL Twitter E-mail

General

Target

e3bd1defb21887ccef4d8b5cb151a872b040741fd6733780f3162cbb6afe75ba
Size

2.8MB
MD5

e176fc2ad5170632e549653b9b9bdde4
SHA1

2fd5c23b389c3d8183f29c6f73ff137ed6b6c97e
SHA256

e3bd1defb21887ccef4d8b5cb151a872b040741fd6733780f3162cbb6afe75ba
SHA512

48dda1bc76c8951fe44f29bb36a085d30713917fd8bb95dfd43deb63d4e42dd2b5f548cb5a6a9849a400aecb0c8866063b79bd5106525deb13255accbcc9e9c3
SSDEEP

49152:+FBjUmHvVhJsMH/4NYeFiAfdyXdcHSjrGiEr48/DrmqEDjT2+:6pHthTf4NYABfdyXd4SjXErNE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e3bd1defb21887ccef4d8b5cb151a872b040741fd6733780f3162cbb6afe75ba

Files

e3bd1defb21887ccef4d8b5cb151a872b040741fd6733780f3162cbb6afe75ba
.dll windows:6 windows x86 arch:x86

cb7e8512b1244c0e07664d1ba9ee3750

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\code\workspace\netfilterinterface\output\NetFilterInterface.pdb

Imports

ws2_32

ntohs
WSACleanup
gethostname
recv
getservbyname
WSAGetLastError
WSAStringToAddressA
WSAAddressToStringA
WSAAddressToStringW
inet_ntoa
WSASetLastError
getaddrinfo
freeaddrinfo
WSASendTo
accept
shutdown
connect
WSARecv
bind
ntohl
listen
WSASocketW
getpeername
getsockname
getsockopt
send
WSASend
WSARecvFrom
ioctlsocket
setsockopt
htonl
__WSAFDIsSet
WSAIoctl
closesocket
select
inet_addr
socket
recvfrom
htons
sendto
WSAStartup

iphlpapi

FreeMibTable
GetUnicastIpAddressTable
GetAdaptersInfo
GetAdaptersAddresses
GetNetworkParams

winmm

timeEndPeriod
timeGetDevCaps
timeSetEvent
timeGetTime
timeKillEvent
timeBeginPeriod

kernel32

HeapFree
FlushFileBuffers
GetStdHandle
SetFilePointerEx
GetFileSizeEx
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
CompareStringW
HeapAlloc
GetFileType
EnterCriticalSection
OutputDebugStringA
WaitForMultipleObjects
LeaveCriticalSection
WaitForSingleObject
GetCurrentThreadId
PostQueuedCompletionStatus
GetLastError
SetEvent
TerminateThread
TlsAlloc
CloseHandle
QueueUserAPC
LocalFree
DeleteCriticalSection
TlsFree
FormatMessageA
Sleep
ReleaseSemaphore
CreateSemaphoreW
SetWaitableTimer
TlsSetValue
SetLastError
InitializeCriticalSectionAndSpinCount
GetQueuedCompletionStatus
CreateEventW
CancelIoEx
SleepEx
TlsGetValue
CreateIoCompletionPort
CreateWaitableTimerW
lstrlenW
GetModuleFileNameW
GetEnvironmentVariableA
CreateFileW
OpenProcess
CreateToolhelp32Snapshot
LCMapStringW
Process32NextW
GetVersionExA
QueryPerformanceFrequency
GlobalAlloc
Process32FirstW
GlobalFree
GetSystemInfo
LoadLibraryW
GetProcAddress
GetFileSize
GetModuleHandleW
FreeLibrary
WideCharToMultiByte
QueryFullProcessImageNameW
QueryPerformanceCounter
DeleteFileW
MoveFileExW
GetCurrentProcessId
CopyFileW
MoveFileW
GetDriveTypeW
GetLogicalDriveStringsW
QueryDosDeviceW
ReadFile
WriteFile
GetOverlappedResult
DeviceIoControl
CancelIo
ResetEvent
CreateEventA
GetTickCount
GetModuleHandleA
CreateFileA
GetLocalTime
IsDebuggerPresent
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
HeapSize
GetTimeZoneInformation
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
SetEndOfFile
WriteConsoleW
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetEnvironmentVariableW
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
GetLogicalProcessorInformation
CreateThread
LoadLibraryExW
InterlockedFlushSList
VirtualAlloc
RtlUnwind
InitializeConditionVariable
InitializeSRWLock
FindNextFileW
FindClose
GetWindowsDirectoryA
ExpandEnvironmentStringsA
MultiByteToWideChar
GetLocaleInfoEx
GetCPInfoExW
InitOnceComplete
InitOnceBeginInitialize
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
WaitForSingleObjectEx
SwitchToThread
GetExitCodeThread
ReleaseSRWLockShared
AcquireSRWLockShared
SleepConditionVariableSRW
RaiseException
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
WakeConditionVariable
WakeAllConditionVariable
GetSystemTimeAsFileTime
CompareStringEx
GetCPInfo
GetStringTypeW
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW

advapi32

LookupPrivilegeValueA
OpenServiceW
QueryServiceConfigW
DeleteService
RegEnumKeyExA
OpenSCManagerW
CloseServiceHandle
StartServiceA
CreateServiceW
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
QueryServiceStatusEx
AdjustTokenPrivileges
OpenProcessToken
QueryServiceStatus
OpenSCManagerA
ControlService
StartServiceW
OpenServiceA

shell32

SHGetSpecialFolderPathW

mswsock

AcceptEx
GetAcceptExSockaddrs

shlwapi

PathFileExistsW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

dnsapi

DnsQueryConfig

wintrust

WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
WTHelperGetProvCertFromChain
WinVerifyTrust

crypt32

CertGetNameStringW

ntdll

NtQueryInformationProcess

dbghelp

SymFromAddr

Exports

Exports

GetFlow
Init
SetBlur
SetConfig
SetExtraConfig
SetRouteConfig
SetRouteServer
SetUdp2Tcp
Start
Stop
StopPre
UnInit
UnInstallDriver

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 483KB - Virtual size: 483KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 91KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cb7e8512b1244c0e07664d1ba9ee3750

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

iphlpapi

winmm

kernel32

advapi32

shell32

mswsock

shlwapi

version

dnsapi

wintrust

crypt32

ntdll

dbghelp

Exports

Exports

Sections

.text Size: 2.2MB - Virtual size: 2.2MB

.rdata Size: 483KB - Virtual size: 483KB

.data Size: 91KB - Virtual size: 101KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 85KB - Virtual size: 85KB

.text
Size: 2.2MB - Virtual size: 2.2MB

.rdata
Size: 483KB - Virtual size: 483KB

.data
Size: 91KB - Virtual size: 101KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 85KB - Virtual size: 85KB