eeeb59e75eb6b06cee1122dfe21fbe50N

Sharing

Copy URL Twitter E-mail

General

Target

eeeb59e75eb6b06cee1122dfe21fbe50N
Size

185KB
MD5

eeeb59e75eb6b06cee1122dfe21fbe50
SHA1

bd46405a058b73f18703754ba3945f81d3aa1356
SHA256

d8114e5956f0f7769bc9f887093e4c5a915391d24c59ddef15ccceb0bbbda363
SHA512

7e514dfbe709ef4945fab3cb9aff2067a5cdff3df644290d703157a71a966d729f06222ec0f2ece0ebfeba349bf22856df8f227d8a9c8b420bd5a1b6f8a22653
SSDEEP

3072:+rYPJKN6vtwRlIUikpziYBf7X2PwxuJI+efmpTQt9FXDJe/:kXN6W3Fup+XVe/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eeeb59e75eb6b06cee1122dfe21fbe50N

Files

eeeb59e75eb6b06cee1122dfe21fbe50N
.dll windows:5 windows x86 arch:x86

60d7a78e36584a1f1457c84a43d8b658

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

select
send
ntohl
setsockopt
socket
gethostbyaddr
gethostbyname
WSAGetLastError
getservbyport
getservbyname
WSAStartup
htons
WSASetLastError
inet_pton
WSADuplicateSocketA
recv
ntohs
listen
inet_ntoa
inet_addr
connect
closesocket
bind
accept
htonl

crypt32

CryptImportPublicKeyInfo
CryptDecodeObjectEx
CertGetCertificateContextProperty
CryptStringToBinaryA

wininet

InternetCrackUrlW
InternetCloseHandle
InternetConnectW
InternetReadFile
InternetSetOptionW
HttpOpenRequestW
HttpSendRequestW
HttpQueryInfoW
InternetOpenW

winhttp

WinHttpConnect
WinHttpReadData
WinHttpQueryOption
WinHttpSetOption
WinHttpCloseHandle
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpOpen
WinHttpCrackUrl
WinHttpOpenRequest
WinHttpSendRequest

kernel32

GetStringTypeW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
OutputDebugStringW
LoadLibraryExW
LeaveCriticalSection
EnterCriticalSection
RaiseException
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetProcAddress
FlushInstructionCache
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WriteProcessMemory
LoadLibraryA
LoadLibraryW
GetModuleHandleA
ExitProcess
SetUnhandledExceptionFilter
ExitThread
GetLastError
GetSystemDirectoryW
GetVolumeInformationW
GetComputerNameW
FreeLibrary
GetCurrentProcess
GetCurrentThreadId
SetLastError
GetModuleHandleW
LocalAlloc
GetOverlappedResult
ResetEvent
WriteFile
ReadFile
CloseHandle
ConnectNamedPipe
CreateEventW
CreateNamedPipeA
Sleep
DuplicateHandle
SetHandleInformation
SetNamedPipeHandleState
PeekNamedPipe
CreateFileW
CreateNamedPipeW
GetSystemDirectoryA
CreateThread
WaitForMultipleObjects
GetTickCount
CreateMutexW
GlobalFree
TerminateProcess
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetModuleFileNameA
GetStartupInfoW
DeleteCriticalSection
GetFileType
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FlushFileBuffers
RtlUnwind
LCMapStringW
HeapSize
GetModuleFileNameW
SetStdHandle
WriteConsoleW
GetCurrentProcessId
GetFileSize
CreateFileA
TerminateThread
ResumeThread
SetEvent
ReleaseMutex
WaitForSingleObject
CreateMutexA
CreateEventA
GetSystemTime
SystemTimeToFileTime
LocalFree
VirtualAllocEx
OpenProcess
VirtualQueryEx
OpenThread
SuspendThread
GetVersionExA
CreateToolhelp32Snapshot
Thread32First
Thread32Next
CreateRemoteThread
GetThreadId
HeapFree
HeapAlloc
HeapReAlloc
GetSystemTimeAsFileTime
WideCharToMultiByte
MultiByteToWideChar
GetCommandLineA
IsDebuggerPresent
IsProcessorFeaturePresent
GetProcessHeap
GetModuleHandleExW
GetStdHandle

user32

GetThreadDesktop
GetUserObjectInformationW
GetProcessWindowStation

advapi32

InitializeAcl
CryptDuplicateKey
CryptDecrypt
CryptEncrypt
CryptImportKey
CryptGenRandom
CryptSetKeyParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextA
ImpersonateLoggedOnUser
SetEntriesInAclW
LookupPrivilegeValueW
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
LookupPrivilegeValueA
AllocateAndInitializeSid
AdjustTokenPrivileges
OpenThreadToken
OpenProcessToken

ole32

CoCreateGuid

dnsapi

DnsQuery_W
DnsFree

Exports

Exports

Init
_ReflectiveLoader@0
_scheduler_waitable_thread@4
buffer_from_file
buffer_to_file
channel_close
channel_create
channel_create_datagram
channel_create_pool
channel_create_stream
channel_default_io_handler
channel_destroy
channel_exists
channel_find_by_id
channel_get_buffered_io_context
channel_get_class
channel_get_flags
channel_get_id
channel_get_native_io_context
channel_get_type
channel_interact
channel_is_flag
channel_is_interactive
channel_open
channel_read
channel_read_from_buffered
channel_set_buffered_io_handler
channel_set_flags
channel_set_interactive
channel_set_native_io_context
channel_set_type
channel_write
channel_write_to_buffered
channel_write_to_remote
command_deregister
command_deregister_all
command_handle
command_join_threads
command_register
command_register_all
core_update_desktop
core_update_thread_token
packet_add_completion_handler
packet_add_exception
packet_add_group
packet_add_request_id
packet_add_tlv_bool
packet_add_tlv_group
packet_add_tlv_qword
packet_add_tlv_raw
packet_add_tlv_string
packet_add_tlv_uint
packet_add_tlv_wstring
packet_add_tlv_wstring_len
packet_add_tlvs
packet_call_completion_handlers
packet_create
packet_create_group
packet_create_response
packet_destroy
packet_enum_tlv
packet_get_tlv
packet_get_tlv_group_entry
packet_get_tlv_meta
packet_get_tlv_string
packet_get_tlv_value_bool
packet_get_tlv_value_qword
packet_get_tlv_value_raw
packet_get_tlv_value_string
packet_get_tlv_value_uint
packet_get_tlv_value_wstring
packet_get_type
packet_is_tlv_null_terminated
packet_remove_completion_handler
packet_transmit
packet_transmit_empty_response
packet_transmit_response
scheduler_destroy
scheduler_initialize
scheduler_insert_waitable
scheduler_signal_waitable

Sections

.text
Size: 137KB - Virtual size: 137KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

60d7a78e36584a1f1457c84a43d8b658

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

crypt32

wininet

winhttp

kernel32

user32

advapi32

ole32

dnsapi

Exports

Exports

Sections

.text Size: 137KB - Virtual size: 137KB

.rdata Size: 26KB - Virtual size: 26KB

.data Size: 13KB - Virtual size: 27KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 137KB - Virtual size: 137KB

.rdata
Size: 26KB - Virtual size: 26KB

.data
Size: 13KB - Virtual size: 27KB

.reloc
Size: 6KB - Virtual size: 5KB