d79033b18280a291a7d427c91def32b0N

Sharing

Copy URL

Twitter E-mail

General

Target

d79033b18280a291a7d427c91def32b0N
Size

2.2MB
MD5

d79033b18280a291a7d427c91def32b0
SHA1

6c0f23dd2d78e16ad6da8dec073ad503acc26aec
SHA256

34721a184cadac6dd4837ba3b928b650541e06f3ba12823d6dff8446302333c9
SHA512

74e5ea244e39b030f7742ce564b24ecb576e578d7364c85b714e1fb949fe14051123764464a960216ceada7fc07d50787c6eae038bb3ea69e5e46a9b87aabe5b
SSDEEP

49152:BJIgK6oy+gAJTs0dzVv71WzDVu0VLGMb5Cx0taAUgLdpq+Xvna9k7VoiX996Kc2a:N+gAJNDQVu0VLGMb5Cx0taAUgLdpq+XH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d79033b18280a291a7d427c91def32b0N

Files

d79033b18280a291a7d427c91def32b0N
.exe windows:6 windows x64 arch:x64

4dcb33cef94c77d19e99fa548571cb55

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\workspace\src\win32\win32-prj\snort\x64\Release\SophosIPS.pdb

Imports

iphlpapi

GetAdaptersAddresses

wsock32

htons
htonl
ntohl
ntohs
gethostbyname
getprotobyname
getservbyname
ioctlsocket
getprotobynumber
WSAStartup
WSAGetLastError
closesocket
sendto
socket
gethostname

advapi32

RegSetValueExA
RegCreateKeyA
RegCloseKey
ReportEventA
RegisterEventSourceA
DeregisterEventSource
IsTextUnicode

bcrypt

BCryptGenRandom

ws2_32

inet_ntop
inet_pton

kernel32

TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
QueryPerformanceCounter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetModuleHandleW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
UnhandledExceptionFilter
TlsSetValue
TlsGetValue
TlsAlloc
FindClose
FindFirstFileA
FindNextFileA
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryA
Sleep
FindCloseChangeNotification
FindFirstChangeNotificationA
FindNextChangeNotification
WaitForSingleObject
GetSystemDirectoryA
SetDllDirectoryA
GetCurrentDirectoryA
GetModuleHandleA
LocalFree
FormatMessageA
GetModuleFileNameA
CloseHandle
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
GetCurrentThread

vcruntime140

__intrinsic_setjmp
longjmp
__current_exception_context
__C_specific_handler
memcpy
memset
memchr
memcmp
strchr
strstr
strrchr
memmove
__current_exception

api-ms-win-crt-string-l1-1-0

isprint
strncpy
strcat_s
strcpy_s
strncpy_s
isspace
_stricmp
_strdup
strtok
isupper
isxdigit
toupper
strncat
strcmp
isalpha
isdigit
isalnum
isgraph
tolower
_strnicmp
strncmp

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_cexit
__p___argc
_c_exit
_get_initial_narrow_environment
_errno
_initialize_narrow_environment
_configure_narrow_argv
_register_thread_local_exe_atexit_callback
_set_app_type
_seh_filter_exe
__p___argv
_beginthreadex
terminate
_crt_atexit
_getpid
exit
strerror
_initterm
abort
_exit
signal
raise
_initialize_onexit_table
_register_onexit_function
_endthreadex

api-ms-win-crt-convert-l1-1-0

strtol
atoi
strtoul

api-ms-win-crt-stdio-l1-1-0

_close
_read
_open
__acrt_iob_func
fread
clearerr
__stdio_common_vfprintf
fputs
_fileno
fflush
fclose
ferror
feof
_chsize
__stdio_common_vsprintf_s
fgets
_getcwd
fopen
_set_fmode
setvbuf
putc
fwrite
__stdio_common_vsprintf
ftell
fseek
getc
__p__commode
fputc

api-ms-win-crt-heap-l1-1-0

malloc
_set_new_mode
calloc
free
realloc

api-ms-win-crt-utility-l1-1-0

qsort
rand
srand
bsearch

api-ms-win-crt-filesystem-l1-1-0

_umask
_mkdir
_fstat64i32
_access
_unlink
_stat64i32
rename
_splitpath
_makepath

api-ms-win-crt-time-l1-1-0

_localtime64
_ctime64
strftime
_ftime64
_time64
_gmtime64

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-math-l1-1-0

__setusermatherr
ceil

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-process-l1-1-0

_execvp

Exports

Exports

daq_acquire
daq_acquire_with_meta
daq_breakloop
daq_check_status
daq_clear_error
daq_config_clear_value
daq_config_clear_values
daq_config_get_value
daq_config_set_value
daq_dp_add_dc
daq_find_module
daq_free_module_list
daq_get_capabilities
daq_get_datalink_type
daq_get_device_index
daq_get_error
daq_get_module_list
daq_get_name
daq_get_snaplen
daq_get_stats
daq_get_type
daq_hup_apply
daq_hup_post
daq_hup_prep
daq_initialize
daq_inject
daq_load_modules
daq_mode_string
daq_modify_flow
daq_print_stats
daq_reset_stats
daq_set_filter
daq_set_verbosity
daq_shutdown
daq_start
daq_state_string
daq_stop
daq_unload_modules
daq_verdict_string
initOutputPlugins
pcre_callout
pcre_compile
pcre_compile2
pcre_exec
pcre_free
pcre_free_study
pcre_fullinfo
pcre_malloc
pcre_stack_free
pcre_stack_guard
pcre_stack_malloc
pcre_study
pcre_version

Sections

.text
Size: 980KB - Virtual size: 979KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 384KB - Virtual size: 383KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 14.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 53KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 232KB - Virtual size: 232KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 568KB - Virtual size: 572KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4dcb33cef94c77d19e99fa548571cb55

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

iphlpapi

wsock32

advapi32

bcrypt

ws2_32

kernel32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-process-l1-1-0

Exports

Exports

Sections

.text Size: 980KB - Virtual size: 979KB

.rdata Size: 384KB - Virtual size: 383KB

.data Size: 28KB - Virtual size: 14.5MB

.pdata Size: 53KB - Virtual size: 52KB

.rsrc Size: 232KB - Virtual size: 232KB

.reloc Size: 568KB - Virtual size: 572KB

.text
Size: 980KB - Virtual size: 979KB

.rdata
Size: 384KB - Virtual size: 383KB

.data
Size: 28KB - Virtual size: 14.5MB

.pdata
Size: 53KB - Virtual size: 52KB

.rsrc
Size: 232KB - Virtual size: 232KB

.reloc
Size: 568KB - Virtual size: 572KB