93c986c69364fa80fd437b03b97e2078157b4696d3c95738263ce567c50995d3

Sharing

Copy URL

Twitter E-mail

General

Target

93c986c69364fa80fd437b03b97e2078157b4696d3c95738263ce567c50995d3
Size

1.9MB
MD5

426de988cd3e1a8c867dfb5298499835
SHA1

0f3d0bcc68d4f01a30051d0dbdaf0be7be1212db
SHA256

93c986c69364fa80fd437b03b97e2078157b4696d3c95738263ce567c50995d3
SHA512

045ea1d8bd854f1844b16b5ff689dfe21d01df25051e0eeb931361cfa51008243485e58e3b33c2ac954218ffed3b56530918f1c50b904a4dfea8b063fa3d34a9
SSDEEP

49152:vxGpE9TgvCu0zUR+xDVYSALEH4VVAxftk46GmyQ/j5Tu1JsqYLR0nja+0j0xljY+:5GpE9TgvCu0zUR+xDVYSALEH4VVAxftr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
93c986c69364fa80fd437b03b97e2078157b4696d3c95738263ce567c50995d3

Files

93c986c69364fa80fd437b03b97e2078157b4696d3c95738263ce567c50995d3
.dll windows:6 windows x86 arch:x86

0565585455b431a43e6d555cda173fe7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\zyh\Documents\SDVN_CLIENT_PC\Release\nas_api.pdb

Imports

libcurl_winsspi_x86

curl_multi_add_handle
curl_easy_perform
curl_easy_getinfo
curl_version
curl_formfree
curl_multi_perform
curl_easy_setopt
curl_easy_cleanup
curl_slist_free_all
curl_multi_init
curl_formadd
curl_multi_cleanup
curl_slist_append
curl_easy_init
curl_global_cleanup
curl_multi_wait
curl_multi_info_read
curl_global_init
curl_multi_remove_handle

ole32

CoCreateGuid

shell32

SHGetSpecialFolderPathW
SHGetSpecialFolderPathA

kernel32

WaitForSingleObjectEx
WriteConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
SetStdHandle
GetCurrentDirectoryW
GetProcessHeap
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
Sleep
DeleteFileA
MoveFileA
GetCurrentThreadId
AreFileApisANSI
ReadFile
HeapCreate
HeapFree
EnterCriticalSection
GetFullPathNameW
WriteFile
GetDiskFreeSpaceW
LockFile
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
CreateFileW
GetFileAttributesW
UnmapViewOfFile
HeapValidate
HeapSize
MultiByteToWideChar
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetLastError
GetFileAttributesA
GetFileAttributesExW
CreateFileA
LoadLibraryA
GetVersionExA
DeleteFileW
HeapReAlloc
CloseHandle
GetSystemInfo
LoadLibraryW
HeapAlloc
HeapDestroy
UnlockFile
GetProcAddress
CreateFileMappingA
LocalFree
LockFileEx
GetFileSize
DeleteCriticalSection
GetCurrentProcessId
SystemTimeToFileTime
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
GetModuleFileNameA
GetModuleFileNameW
CreateDirectoryA
TryEnterCriticalSection
WaitForSingleObject
SetEvent
ResetEvent
CreateEventA
TerminateThread
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
GetExitCodeThread
RaiseException
EncodePointer
DecodePointer
LCMapStringEx
GetModuleHandleW
GetLocaleInfoEx
GetStringTypeW
CompareStringEx
GetCPInfo
InitializeCriticalSectionAndSpinCount
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
GetTimeFormatW
RtlUnwind
InterlockedFlushSList
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateDirectoryW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetTimeZoneInformation
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetFileSizeEx
SetFilePointerEx
GetStdHandle
GetConsoleOutputCP
GetConsoleMode
GetDateFormatW

Exports

Exports

getVersionInfo
get_transfer_data_path
global_init
global_init_with_path
nas_cancel_request
nas_enable_transfer_speed
nas_free
nas_get_error_message
nas_init
nas_request
nas_request_async
nas_set_debug_model
nas_set_package_name
nas_set_parallel_transfer_number
nas_set_server_address
nas_uninit
refresh_ticket

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 210KB - Virtual size: 209KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0565585455b431a43e6d555cda173fe7

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

libcurl_winsspi_x86

ole32

shell32

kernel32

Exports

Exports

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 210KB - Virtual size: 209KB

.data Size: 14KB - Virtual size: 22KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 62KB - Virtual size: 62KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 210KB - Virtual size: 209KB

.data
Size: 14KB - Virtual size: 22KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 62KB - Virtual size: 62KB