784fa109476bb7532275bc90f87bf22dcbbe05905ded2467691d4e89decdd603

Sharing

Copy URL Twitter E-mail

General

Target

784fa109476bb7532275bc90f87bf22dcbbe05905ded2467691d4e89decdd603
Size

1.4MB
MD5

91073bb52b1360551a98cccd21ed321b
SHA1

8c39c01b3d871ce9d913581f565cea1280db6f70
SHA256

784fa109476bb7532275bc90f87bf22dcbbe05905ded2467691d4e89decdd603
SHA512

54f465175992b6c52a935e6dc02e4e26ae23cf929c5c57172ad5935e32ff6b6eb08fa2cfee47a62166a5014e72e05676ca967eb5af444c8d852cbc66097879cc
SSDEEP

12288:ulo3pZfDsL8ufOt2CwP5vD+NnfqxzFRMs4zup397rRKY8Ib6:ulo5ZfVufOtkBvD+Nfiiz0Zlb6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
784fa109476bb7532275bc90f87bf22dcbbe05905ded2467691d4e89decdd603

Files

784fa109476bb7532275bc90f87bf22dcbbe05905ded2467691d4e89decdd603
.dll windows:5 windows x64 arch:x64

a040ec6fcd89560994621cf676b67cbc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

FreeLibrary
GetProcAddress
GetSystemDirectoryA
DeviceIoControl
CloseHandle
CreateFileA
GetLastError
WriteFile
LoadLibraryA
VirtualProtect
GetModuleHandleA
GetCurrentThread
DisableThreadLibraryCalls
SuspendThread
VirtualFree
GetThreadContext
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
GetCurrentThreadId
FlsSetValue
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
HeapSetInformation
GetVersion
HeapCreate
HeapDestroy
GetModuleHandleW
ExitProcess
DecodePointer
GetStdHandle
GetModuleFileNameW
EncodePointer
RaiseException
RtlPcToFileHeader
FlsGetValue
FlsFree
SetLastError
FlsAlloc
RtlUnwindEx
Sleep
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
HeapSize
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapReAlloc
LCMapStringW
MultiByteToWideChar
GetStringTypeW
VirtualQuery
ResumeThread
FlushInstructionCache
SetThreadContext
VirtualAlloc

user32

MessageBoxA

Exports

Exports

AddIPAddress
AllocateAndGetInterfaceInfoFromStack
AllocateAndGetIpAddrTableFromStack
CPNatfwtCreateProviderInstance
CPNatfwtDeregisterProviderInstance
CPNatfwtDestroyProviderInstance
CPNatfwtIndicateReceivedBuffers
CPNatfwtRegisterProviderInstance
CancelIPChangeNotify
CancelMibChangeNotify2
ConvertGuidToStringA
ConvertGuidToStringW
ConvertInterfaceAliasToLuid
ConvertInterfaceGuidToLuid
ConvertInterfaceIndexToLuid
ConvertInterfaceLuidToAlias
ConvertInterfaceLuidToGuid
ConvertInterfaceLuidToIndex
ConvertInterfaceLuidToNameA
ConvertInterfaceLuidToNameW
ConvertInterfaceNameToLuidA
ConvertInterfaceNameToLuidW
ConvertInterfacePhysicalAddressToLuid
ConvertIpv4MaskToLength
ConvertLengthToIpv4Mask
ConvertRemoteInterfaceAliasToLuid
ConvertRemoteInterfaceGuidToLuid
ConvertRemoteInterfaceIndexToLuid
ConvertRemoteInterfaceLuidToAlias
ConvertRemoteInterfaceLuidToGuid
ConvertRemoteInterfaceLuidToIndex
ConvertStringToGuidA
ConvertStringToGuidW
ConvertStringToInterfacePhysicalAddress
CreateAnycastIpAddressEntry
CreateIpForwardEntry
CreateIpForwardEntry2
CreateIpNetEntry
CreateIpNetEntry2
CreatePersistentTcpPortReservation
CreatePersistentUdpPortReservation
CreateProxyArpEntry
CreateSortedAddressPairs
CreateUnicastIpAddressEntry
DeleteAnycastIpAddressEntry
DeleteIPAddress
DeleteIpForwardEntry
DeleteIpForwardEntry2
DeleteIpNetEntry
DeleteIpNetEntry2
DeletePersistentTcpPortReservation
DeletePersistentUdpPortReservation
DeleteProxyArpEntry
DeleteUnicastIpAddressEntry
DisableMediaSense
EnableRouter
FlushIpNetTable
FlushIpNetTable2
FlushIpPathTable
FreeMibTable
GetAdapterIndex
GetAdapterOrderMap
GetAdaptersAddresses
GetAdaptersInfo
GetAnycastIpAddressEntry
GetAnycastIpAddressTable
GetBestInterface
GetBestInterfaceEx
GetBestRoute
GetBestRoute2
GetCurrentThreadCompartmentId
GetExtendedTcpTable
GetExtendedUdpTable
GetFriendlyIfIndex
GetIcmpStatistics
GetIcmpStatisticsEx
GetIfEntry
GetIfEntry2
GetIfStackTable
GetIfTable
GetIfTable2
GetIfTable2Ex
GetInterfaceInfo
GetInvertedIfStackTable
GetIpAddrTable
GetIpErrorString
GetIpForwardEntry2
GetIpForwardTable
GetIpForwardTable2
GetIpInterfaceEntry
GetIpInterfaceTable
GetIpNetEntry2
GetIpNetTable
GetIpNetTable2
GetIpPathEntry
GetIpPathTable
GetIpStatistics
GetIpStatisticsEx
GetMulticastIpAddressEntry
GetMulticastIpAddressTable
GetNetworkInformation
GetNetworkParams
GetNumberOfInterfaces
GetOwnerModuleFromPidAndInfo
GetOwnerModuleFromTcp6Entry
GetOwnerModuleFromTcpEntry
GetOwnerModuleFromUdp6Entry
GetOwnerModuleFromUdpEntry
GetPerAdapterInfo
GetPerTcp6ConnectionEStats
GetPerTcp6ConnectionStats
GetPerTcpConnectionEStats
GetPerTcpConnectionStats
GetRTTAndHopCount
GetSessionCompartmentId
GetTcp6Table
GetTcp6Table2
GetTcpStatistics
GetTcpStatisticsEx
GetTcpTable
GetTcpTable2
GetTeredoPort
GetUdp6Table
GetUdpStatistics
GetUdpStatisticsEx
GetUdpTable
GetUniDirectionalAdapterInfo
GetUnicastIpAddressEntry
GetUnicastIpAddressTable
Icmp6CreateFile
Icmp6ParseReplies
Icmp6SendEcho2
IcmpCloseHandle
IcmpCreateFile
IcmpParseReplies
IcmpSendEcho
IcmpSendEcho2
IcmpSendEcho2Ex
InitializeIpForwardEntry
InitializeIpInterfaceEntry
InitializeUnicastIpAddressEntry
InternalCleanupPersistentStore
InternalCreateAnycastIpAddressEntry
InternalCreateIpForwardEntry
InternalCreateIpForwardEntry2
InternalCreateIpNetEntry
InternalCreateIpNetEntry2
InternalCreateUnicastIpAddressEntry
InternalDeleteAnycastIpAddressEntry
InternalDeleteIpForwardEntry
InternalDeleteIpForwardEntry2
InternalDeleteIpNetEntry
InternalDeleteIpNetEntry2
InternalDeleteUnicastIpAddressEntry
InternalFindInterfaceByAddress
InternalGetAnycastIpAddressEntry
InternalGetAnycastIpAddressTable
InternalGetForwardIpTable2
InternalGetIfEntry2
InternalGetIfTable
InternalGetIfTable2
InternalGetIpAddrTable
InternalGetIpForwardEntry2
InternalGetIpForwardTable
InternalGetIpInterfaceEntry
InternalGetIpInterfaceTable
InternalGetIpNetEntry2
InternalGetIpNetTable
InternalGetIpNetTable2
InternalGetMulticastIpAddressEntry
InternalGetMulticastIpAddressTable
InternalGetTcp6Table2
InternalGetTcp6TableWithOwnerModule
InternalGetTcp6TableWithOwnerPid
InternalGetTcpTable
InternalGetTcpTable2
InternalGetTcpTableEx
InternalGetTcpTableWithOwnerModule
InternalGetTcpTableWithOwnerPid
InternalGetTunnelPhysicalAdapter
InternalGetUdp6TableWithOwnerModule
InternalGetUdp6TableWithOwnerPid
InternalGetUdpTable
InternalGetUdpTableEx
InternalGetUdpTableWithOwnerModule
InternalGetUdpTableWithOwnerPid
InternalGetUnicastIpAddressEntry
InternalGetUnicastIpAddressTable
InternalSetIfEntry
InternalSetIpForwardEntry
InternalSetIpForwardEntry2
InternalSetIpInterfaceEntry
InternalSetIpNetEntry
InternalSetIpNetEntry2
InternalSetIpStats
InternalSetTcpEntry
InternalSetTeredoPort
InternalSetUnicastIpAddressEntry
IpReleaseAddress
IpRenewAddress
LookupPersistentTcpPortReservation
LookupPersistentUdpPortReservation
NTPTimeToNTFileTime
NTTimeToNTPTime
NhGetGuidFromInterfaceName
NhGetInterfaceDescriptionFromGuid
NhGetInterfaceNameFromDeviceGuid
NhGetInterfaceNameFromGuid
NhpAllocateAndGetInterfaceInfoFromStack
NotifyAddrChange
NotifyIpInterfaceChange
NotifyRouteChange
NotifyRouteChange2
NotifyStableUnicastIpAddressTable
NotifyTeredoPortChange
NotifyUnicastIpAddressChange
ResolveIpNetEntry2
ResolveNeighbor
RestoreMediaSense
SendARP
SetAdapterIpAddress
SetCurrentThreadCompartmentId
SetIfEntry
SetIpForwardEntry
SetIpForwardEntry2
SetIpInterfaceEntry
SetIpNetEntry
SetIpNetEntry2
SetIpStatistics
SetIpStatisticsEx
SetIpTTL
SetNetworkInformation
SetPerTcp6ConnectionEStats
SetPerTcp6ConnectionStats
SetPerTcpConnectionEStats
SetPerTcpConnectionStats
SetSessionCompartmentId
SetTcpEntry
SetUnicastIpAddressEntry
UnenableRouter
_ParseNetworkString
_PfAddFiltersToInterface
_PfAddGlobalFilterToInterface
_PfBindInterfaceToIPAddress
_PfBindInterfaceToIndex
_PfCreateInterface
_PfDeleteInterface
_PfDeleteLog
_PfGetInterfaceStatistics
_PfMakeLog
_PfRebindFilters
_PfRemoveFilterHandles
_PfRemoveFiltersFromInterface
_PfRemoveGlobalFilterFromInterface
_PfSetLogBuffer
_PfTestPacket
_PfUnBindInterface
do_echo_rep
do_echo_req
if_indextoname
if_nametoindex
register_icmp

Sections

.text
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1008KB - Virtual size: 1008KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data0
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data1
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.vmp
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp
Size: 224KB - Virtual size: 224KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a040ec6fcd89560994621cf676b67cbc

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

Exports

Exports

Sections

.text Size: 56KB - Virtual size: 56KB

.rdata Size: 32KB - Virtual size: 32KB

.data Size: 1008KB - Virtual size: 1008KB

.pdata Size: 4KB - Virtual size: 4KB

.rsrc Size: 4KB - Virtual size: 4KB

.data0 Size: 8KB - Virtual size: 8KB

.data1 Size: 32KB - Virtual size: 32KB

.reloc Size: 4KB - Virtual size: 4KB

.vmp Size: 8KB - Virtual size: 8KB

.vmp Size: 68KB - Virtual size: 68KB

.vmp Size: 224KB - Virtual size: 224KB

.text
Size: 56KB - Virtual size: 56KB

.rdata
Size: 32KB - Virtual size: 32KB

.data
Size: 1008KB - Virtual size: 1008KB

.pdata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 4KB - Virtual size: 4KB

.data0
Size: 8KB - Virtual size: 8KB

.data1
Size: 32KB - Virtual size: 32KB

.reloc
Size: 4KB - Virtual size: 4KB

.vmp
Size: 8KB - Virtual size: 8KB

.vmp
Size: 68KB - Virtual size: 68KB

.vmp
Size: 224KB - Virtual size: 224KB