f6531a87a29566331761a4ead2f9bb6c5efaa211831c1f52d380fce33198a6c8

Sharing

Copy URL Twitter E-mail

General

Target

f6531a87a29566331761a4ead2f9bb6c5efaa211831c1f52d380fce33198a6c8
Size

132KB
MD5

52c553dad64160c596f6fb0f639bb50e
SHA1

8103be96f57c7684cf62f9475ea09975f3df2359
SHA256

f6531a87a29566331761a4ead2f9bb6c5efaa211831c1f52d380fce33198a6c8
SHA512

8c2a2ae8038cf99aa4828414f0b5e8d741d14ee0c9ccb4ec29bcf017e31985ca670ab552836062035146510bc25e2788059fb4cc45e23a5028095603395f63ee
SSDEEP

1536:eNifUWlvV1yKBAHltCvLcaqxxdrS4PM212uS0mZDTmD73vG3d6tO5DpHAaWgfEqc:78HlkL9OEN0mZ3mrO5NH+g8qs3Si

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f6531a87a29566331761a4ead2f9bb6c5efaa211831c1f52d380fce33198a6c8

Files

f6531a87a29566331761a4ead2f9bb6c5efaa211831c1f52d380fce33198a6c8
.dll windows:4 windows x86 arch:x86

b5f68ad0e17deedc708c4203510e84cc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\buildbot\win32-comm-central-nightly\build\objdir-tb\mozilla\nss\ssl\ssl3.pdb

Imports

nss3

NSS_RegisterShutdown
PK11_Finalize
CERT_FreeDistNames
CERT_GetSSLCACerts
SECKEY_CacheStaticFlags
CERT_DupCertList
PK11_MapSignKeyType
PK11_CopyTokenPrivKeyToSessionPrivKey
PK11_ReferenceSlot
PK11_WrapSymKey
CERT_DupDistNames
CERT_GetDefaultCertDB
CERT_FreeNicknames
CERT_CheckCertValidTimes
CERT_GetCertNicknames
PK11_FindKeyByAnyCert
CERT_FindUserCertByUsage
CERT_FindCertByName
PK11_UnwrapSymKey
PK11_SaveContextAlloc
PK11_DigestKey
PK11_RestoreContext
PK11_CreateDigestContext
PK11_Derive
PK11_GetSlotFromKey
PK11_SymKeyFromHandle
NSS_VersionCheck
SECMOD_LookupSlot
PK11_IsPresent
PK11_GetSlotSeries
PK11_GetSlotID
PK11_GetModuleID
PK11_NeedLogin
PK11_IsLoggedIn
PK11_DigestBegin
PK11_DigestOp
PK11_DigestFinal
PK11_CreateContextBySymKey
PK11_IVFromParam
PK11_CipherOp
PK11_ParamFromIV
PK11_DestroyContext
PK11_HashBuf
SECKEY_SignatureLen
DSAU_DecodeDerSigToLen
DSAU_DecodeDerSig
PK11_Verify
PK11_SignatureLen
PK11_Sign
DSAU_EncodeDerSigWithLen
PK11_GenerateRandom
PK11_TokenExists
CERT_ExtractPublicKey
SECKEY_GetPrivateKeyType
VFY_CreateContext
VFY_Begin
VFY_Update
VFY_End
VFY_DestroyContext
SGN_NewContext
SGN_Begin
SGN_Update
SGN_End
SGN_DestroyContext
PK11_PubEncryptRaw
PK11_PubDecryptRaw
PK11_GetBestSlot
__PK11_CreateContextByRawKey
HASH_GetHashObject
CERT_VerifyCertName
CERT_NameToAscii
SECKEY_CopyPrivateKey
CERT_NewTempCertificate
SECKEY_UpdateCertPQG
CERT_VerifyCertNow
PK11_UnwrapSymKeyWithFlags
PK11_ImportSymKey
SECKEY_CreateDHPrivateKey
PK11_PubDerive
CERT_DupCertificate
CERT_CertChainFromCert
PK11_GetSlotFromPrivateKey
PK11_GetInternalSlot
PK11_GetKeyData
CERT_DestroyCertificateList
SECKEY_CreateRSAPrivateKey
PK11_GetCurrentWrapIndex
PK11_GetWrapKey
PK11_GetBestWrapMechanism
PK11_SetWrapKey
PK11_GetMechanism
CERT_DestroyCertificate
PK11_VerifyKeyOK
PK11_ReferenceSymKey
PK11_GetBestKeyLength
PK11_FreeSymKey
SECKEY_PublicKeyStrengthInBits
PK11_GetPrivateModulusLen
PK11_GetBestSlotMultiple
PK11_KeyGen
PK11_FreeSlot
SECKEY_PublicKeyStrength
PK11_PubWrapSymKey
PK11_PrivDecryptPKCS1
PK11_PubUnwrapSymKey
SECKEY_CreateECPrivateKey
SECKEY_DestroyPrivateKey
SECKEY_DestroyPublicKey
PK11_PubDeriveWithKDF
PK11_DeriveWithFlags
PK11_ExtractKeyValue
CERT_DistNamesFromCertList

nssutil3

PORT_ArenaAlloc_Util
PORT_SetError_Util
SECOID_FindOID_Util
SECOID_FindOIDByTag_Util
SECITEM_DupItem_Util
DER_Lengths_Util
NSSRWLock_New_Util
NSSRWLock_Destroy_Util
ATOB_AsciiToData_Util
BTOA_DataToAscii_Util
NSS_PutEnv_Util
SECITEM_Hash
SECOID_GetAlgorithmTag_Util
PORT_Realloc_Util
SECITEM_AllocItem_Util
SECITEM_ZfreeItem_Util
NSS_SecureMemcmp
PORT_ZFree_Util
PORT_NewArena_Util
PORT_ArenaZAlloc_Util
PORT_GetError_Util
PORT_FreeArena_Util
PORT_ZAlloc_Util
SECITEM_CopyItem_Util
PORT_Strdup_Util
SECITEM_CompareItem_Util
NSSRWLock_LockRead_Util
NSSRWLock_UnlockRead_Util
NSSRWLock_LockWrite_Util
NSSRWLock_UnlockWrite_Util
PORT_Alloc_Util
SECITEM_FreeItem_Util
PORT_Free_Util

plc4

PL_strdup

nspr4

PR_FindFunctionSymbol
PR_UnloadLibrary
PR_GetLibraryFilePathname
PR_Free
PR_GetDirectorySeparator
PR_LoadLibraryWithFlags
PR_Now
PR_Close
PR_NewMonitor
PR_CreateIOLayerStub
PR_PushIOLayer
PR_GetUniqueIdentity
PR_GetDefaultIOMethods
PR_GetSocketOption
PR_ConvertIPv4AddrToIPv6
PR_SetError
PR_DestroyMonitor
PR_GetIdentitiesLayer
PR_EmulateAcceptRead
PR_EmulateSendFile
PR_ImportFileMapFromString
PR_ExportFileMapAsString
PR_smprintf
PR_OpenAnonFileMap
PR_smprintf_free
PR_MemMap
PR_MemUnmap
PR_CloseFileMap
PR_StringToNetAddr
PR_CallOnce
PR_CallOnceWithArg
PR_PopIOLayer
PR_GetCurrentThread
PR_ExitMonitor
PR_Sleep
PR_EnterMonitor
PR_GetError
PR_NewLock
PR_Lock
PR_Unlock
PR_DestroyLock
PR_GetEnv

mozcrt19

_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
_initterm_e
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_initterm
_decode_pointer
_encoded_null
free
memcpy
memset
strcmp
memmove
_getpid
memcmp
strstr
strlen
_time64
strchr
getenv
strcpy
strrchr
_encode_pointer
__clean_type_info_names_internal
_malloc_crt

kernel32

GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetCurrentThreadId
WaitForSingleObject
ReleaseMutex
CloseHandle
CreateMutexA
GetLastError
GetSystemTimeAsFileTime

Exports

Exports

NSSSSL_VersionCheck
NSS_CmpCertChainWCANames
NSS_FindCertKEAType
NSS_GetClientAuthData
NSS_SetDomesticPolicy
NSS_SetExportPolicy
NSS_SetFrancePolicy
SSL_AuthCertificate
SSL_AuthCertificateHook
SSL_BadCertHook
SSL_CanBypass
SSL_CertDBHandleSet
SSL_CipherPolicyGet
SSL_CipherPolicySet
SSL_CipherPrefGet
SSL_CipherPrefGetDefault
SSL_CipherPrefSet
SSL_CipherPrefSetDefault
SSL_ClearSessionCache
SSL_ConfigMPServerSIDCache
SSL_ConfigSecureServer
SSL_ConfigSecureServerWithCertChain
SSL_ConfigServerSessionIDCache
SSL_ConfigServerSessionIDCacheWithOpt
SSL_DataPending
SSL_ForceHandshake
SSL_ForceHandshakeWithTimeout
SSL_GetChannelInfo
SSL_GetCipherSuiteInfo
SSL_GetClientAuthDataHook
SSL_GetImplementedCiphers
SSL_GetMaxServerCacheLocks
SSL_GetNegotiatedHostInfo
SSL_GetNumImplementedCiphers
SSL_GetSessionID
SSL_GetStatistics
SSL_HandshakeCallback
SSL_HandshakeNegotiatedExtension
SSL_ImplementedCiphers
SSL_ImportFD
SSL_InheritMPServerSIDCache
SSL_InvalidateSession
SSL_LocalCertificate
SSL_NumImplementedCiphers
SSL_OptionGet
SSL_OptionGetDefault
SSL_OptionSet
SSL_OptionSetDefault
SSL_PeerCertificate
SSL_PreencryptedFileToStream
SSL_PreencryptedStreamToFile
SSL_ReHandshake
SSL_ReHandshakeWithTimeout
SSL_ReconfigFD
SSL_ResetHandshake
SSL_RestartHandshakeAfterCertReq
SSL_RestartHandshakeAfterServerCert
SSL_RevealCert
SSL_RevealPinArg
SSL_RevealURL
SSL_SNISocketConfigHook
SSL_SecurityStatus
SSL_SetMaxServerCacheLocks
SSL_SetPKCS11PinArg
SSL_SetSockPeerID
SSL_SetTrustAnchors
SSL_SetURL
SSL_ShutdownServerSessionIDCache

Sections

.text
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 824B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b5f68ad0e17deedc708c4203510e84cc

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

nss3

nssutil3

plc4

nspr4

mozcrt19

kernel32

Exports

Exports

Sections

.text Size: 92KB - Virtual size: 91KB

.rdata Size: 20KB - Virtual size: 18KB

.data Size: 4KB - Virtual size: 2KB

.rsrc Size: 4KB - Virtual size: 824B

.reloc Size: 8KB - Virtual size: 5KB

.text
Size: 92KB - Virtual size: 91KB

.rdata
Size: 20KB - Virtual size: 18KB

.data
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 4KB - Virtual size: 824B

.reloc
Size: 8KB - Virtual size: 5KB