102b2abedbd4047451497abee261117494042a424657ee7fc94d749bb2af96f4

Sharing

Copy URL Twitter E-mail

General

Target

102b2abedbd4047451497abee261117494042a424657ee7fc94d749bb2af96f4
Size

5.8MB
MD5

ba989ee0ba8d1cba1e94c3212a23e641
SHA1

73376be671aa57233dbbadcc3d715045b8556573
SHA256

102b2abedbd4047451497abee261117494042a424657ee7fc94d749bb2af96f4
SHA512

4ced6fa1e332f7297e7385a256b8eccebf38aa0d43f3fbc031d8130fdb0fbdb84e597e327786fa5493c8cd58dcdbda753c70774f7733cdf413e9e14794fd2f82
SSDEEP

98304:YaCI8DkAZulaWADTYWURaiqUB8u7jRhLGiSrUYwEpSeDRJbRe4kL0Q:YaCI8DkAZulhADTYWh4jGiS33pSeRJVe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
102b2abedbd4047451497abee261117494042a424657ee7fc94d749bb2af96f4

Files

102b2abedbd4047451497abee261117494042a424657ee7fc94d749bb2af96f4
.dll windows:6 windows x86 arch:x86

a61d2da7f6d1cca4c07c4feab8acc8cc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\BuildAgent\work\4cded352a6fa841\Build\Symbols\Nightly_Win32\Client Network.pdb

Imports

ws2_32

send
recvfrom
getsockopt
getsockname
ioctlsocket
connect
closesocket
htons
setsockopt
socket
WSACloseEvent
WSAGetLastError
WSAEventSelect
WSAWaitForMultipleEvents
bind
htonl
WSASetLastError
inet_pton
inet_ntop
WSAIoctl
__WSAFDIsSet
accept
listen
recv
getaddrinfo
WSAStartup
WSACreateEvent
WSACleanup
select
gethostname
gethostbyname
sendto
ntohs
inet_ntoa
inet_addr
freeaddrinfo

wininet

InternetCreateUrlA
InternetCrackUrlA

kernel32

OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
Sleep
GetCurrentThreadId
OpenThread
GetThreadTimes
OpenProcess
GetSystemTime
GetLocalTime
GetProcAddress
LoadLibraryA
GlobalAlloc
GlobalUnlock
GlobalLock
LocalFree
FormatMessageW
VerifyVersionInfoW
Thread32First
Thread32Next
FileTimeToLocalFileTime
LocalAlloc
FileTimeToSystemTime
GetTickCount
RaiseException
FreeLibrary
GetModuleHandleExA
DecodePointer
GetModuleHandleA
GetSystemTimeAsFileTime
GetLogicalDrives
LoadLibraryW
GetProcessAffinityMask
SetProcessAffinityMask
HeapAlloc
HeapFree
GetProcessHeap
GetExitCodeProcess
FormatMessageA
WideCharToMultiByte
DebugActiveProcessStop
GetProcessId
CreateFileA
CreateFileW
SetFilePointer
WriteFile
CloseHandle
FreeLibraryAndExitThread
ExitThread
CreateThread
CreateDirectoryW
SetEnvironmentVariableW
DeleteFileW
WriteConsoleW
GetModuleHandleExW
GetFileType
GetStdHandle
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
InterlockedFlushSList
RtlUnwind
InitializeSListHead
GetCurrentProcessId
GetStartupInfoW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetCPInfo
SetFileAttributesA
ReadFile
GetLongPathNameW
GetFullPathNameW
GetFileAttributesExW
GetFileAttributesA
GetCurrentDirectoryW
VerSetConditionMask
SetLastError
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
CreateProcessW
TerminateProcess
CreateEventA
CreateMutexA
GetStringTypeW
WaitForSingleObject
ReleaseMutex
SetEvent
GetLastError
GetTimeZoneInformation
GetDriveTypeW
GetFileInformationByHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
ExitProcess
GetConsoleMode
ReadConsoleW
SetStdHandle
GetConsoleOutputCP
FlushFileBuffers
SetFilePointerEx
OutputDebugStringW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
HeapSize
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
SleepConditionVariableSRW
WakeAllConditionVariable
LCMapStringEx
EncodePointer
TryAcquireSRWLockExclusive
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
FindClose
SetEndOfFile
LoadLibraryExW
LoadLibraryExA
GetModuleHandleW
VirtualQuery
VirtualFree
VirtualProtect
VirtualAlloc
FlushInstructionCache
SetThreadContext
GetThreadContext
ResumeThread
SuspendThread
GetCurrentProcess
GetFileSizeEx
SleepEx
GetEnvironmentVariableA
WaitForSingleObjectEx
MoveFileExA
GetSystemDirectoryA
MultiByteToWideChar
InitializeCriticalSectionEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CreateWaitableTimerA
GetModuleFileNameW
SetWaitableTimer
SetThreadAffinityMask
GetCurrentThread

user32

EmptyClipboard
CloseClipboard
CallWindowProcW
GetWindowLongA
SetClipboardData
OpenClipboard
MessageBoxW
SetWindowLongA
SetWindowLongW
GetWindowTextW
FindWindowA
EnumWindows
GetClassNameW
GetWindowThreadProcessId
GetMessageA
DispatchMessageA
PeekMessageA
PostMessageA
PostThreadMessageA
DefWindowProcW
TranslateMessage
GetSystemMetrics
CallNextHookEx
GetAsyncKeyState
MessageBoxA

advapi32

RegCreateKeyExW
RegFlushKey
RegOpenKeyExW
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
RegSetValueExW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
GetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
QueryServiceObjectSecurity
SetServiceObjectSecurity
SetEntriesInAclA
BuildExplicitAccessWithNameA
ConvertStringSidToSidA
CryptDestroyHash
RegQueryValueExW
CryptHashData
CryptCreateHash

shell32

ShellExecuteExW
SHGetFolderPathW
ShellExecuteA

ole32

CoInitializeSecurity
CoSetProxyBlanket
CoCreateInstance
CoInitializeEx

oleaut32

VariantChangeType
VariantClear
SysAllocStringByteLen
SysFreeString
SysAllocString
SysStringLen

crypt32

CertOpenStore
CertEnumCertificatesInStore
CryptDecodeObjectEx
CertGetNameStringW
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertCloseStore

normaliz

IdnToUnicode
IdnToAscii

pthread

pthread_cond_init
pthread_mutex_unlock
pthread_cond_signal
pthread_mutex_destroy
pthread_mutex_init
pthread_setcancelstate
pthread_create
pthread_cond_destroy
pthread_testcancel
pthread_cond_wait
pthread_cond_timedwait
pthread_mutex_lock
pthread_cancel

winmm

timeGetTime

wintrust

WinVerifyTrust
WTHelperGetProvCertFromChain
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain

iphlpapi

FreeMibTable
GetIpNetTable2
SendARP

bcrypt

BCryptGenRandom

Exports

Exports

CheckCompatibility
CheckService
GetLibMtaVersion
GetNetRel
GetNetRev
InitNetInterface
InitNetRev
NtTerminateProcess
ReleaseNetInterface
SetGTADirectory
SetMTADirectory
WaitForObject
_RoGetActivationFactory@12

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 228KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 135KB - Virtual size: 135KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a61d2da7f6d1cca4c07c4feab8acc8cc

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

wininet

kernel32

user32

advapi32

shell32

ole32

oleaut32

crypt32

normaliz

pthread

winmm

wintrust

iphlpapi

bcrypt

Exports

Exports

Sections

.text Size: 2.6MB - Virtual size: 2.6MB

.rdata Size: 1.9MB - Virtual size: 1.9MB

.data Size: 44KB - Virtual size: 228KB

.detourc Size: 4KB - Virtual size: 4KB

.detourd Size: 512B - Virtual size: 12B

.rsrc Size: 1.1MB - Virtual size: 1.1MB

.reloc Size: 135KB - Virtual size: 135KB

.text
Size: 2.6MB - Virtual size: 2.6MB

.rdata
Size: 1.9MB - Virtual size: 1.9MB

.data
Size: 44KB - Virtual size: 228KB

.detourc
Size: 4KB - Virtual size: 4KB

.detourd
Size: 512B - Virtual size: 12B

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

.reloc
Size: 135KB - Virtual size: 135KB