741b7a4f4f514f9c0e68031bf89aa180N

Sharing

Copy URL Twitter E-mail

General

Target

741b7a4f4f514f9c0e68031bf89aa180N
Size

216KB
MD5

741b7a4f4f514f9c0e68031bf89aa180
SHA1

4f3a3fe1ae247b1e56dcd07d0e5fbad02f1663ed
SHA256

828b95d925fe2764407468c43f8593d9d52e3f10cf5d48f861c165a2ae48265f
SHA512

10d2b7eb7b43f7887a2eb8398d619f9b18b90ddbe906d282d4b5699c63f90564bf664f35e9834c1fb304436cda77b9087b75454d90d1ba425a26353689f458b6
SSDEEP

6144:ZjEs/O7hwrT1OI53XCf4DBaEVPOf8Q9xioMSIw:ehw5jCf4DYExk6oMSIw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
741b7a4f4f514f9c0e68031bf89aa180N

Files

741b7a4f4f514f9c0e68031bf89aa180N
.dll windows:4 windows x64 arch:x64

cffabfa1c5e6518ea78fd9ab55afbaac

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

advapi32

RegCloseKey
RegEnumKeyExA
RegNotifyChangeKeyValue
RegOpenKeyExA
RegOpenKeyExW
RegQueryValueExA
SystemFunction036

iphlpapi

CancelMibChangeNotify2
ConvertInterfaceIndexToLuid
ConvertInterfaceLuidToNameA
FreeMibTable
GetAdaptersAddresses
GetBestRoute2
GetUnicastIpAddressTable
NotifyIpInterfaceChange
if_indextoname
if_nametoindex

kernel32

CloseHandle
CreateEventA
CreateIoCompletionPort
CreateThread
DeleteCriticalSection
EnterCriticalSection
ExpandEnvironmentStringsA
GetCurrentProcess
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetQueuedCompletionStatusEx
GetVersionExA
InitializeConditionVariable
InitializeCriticalSection
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryW
PostQueuedCompletionStatus
QueryPerformanceCounter
QueryPerformanceFrequency
RegisterWaitForSingleObject
SetFileCompletionNotificationModes
SetLastError
Sleep
SleepConditionVariableCS
TerminateProcess
TlsGetValue
UnregisterWait
VirtualProtect
VirtualQuery
WaitForSingleObject
WakeAllConditionVariable
WakeConditionVariable

msvcrt

__iob_func
_amsg_exit
_errno
_initterm
_lock
_stat64
_stricmp
_time64
_unlock
_vscprintf
_vsnprintf
_write
abort
atoi
calloc
fclose
fopen
fread
free
fseek
ftell
fwrite
getenv
malloc
memchr
memcmp
memcpy
memmove
memset
qsort
rand
realloc
setvbuf
srand
strchr
strcmp
strlen
strncat
strncmp
strtoul
vfprintf

ws2_32

WSAGetLastError
WSAIoctl
__WSAFDIsSet
bind
closesocket
connect
gethostname
getservbyname
getservbyport
getsockname
htonl
htons
ioctlsocket
ntohl
ntohs
recv
recvfrom
send
setsockopt
socket

Exports

Exports

ares_cancel
ares_create_query
ares_destroy
ares_destroy_options
ares_dns_addr_to_ptr
ares_dns_class_fromstr
ares_dns_class_tostr
ares_dns_opcode_tostr
ares_dns_opt_get_datatype
ares_dns_opt_get_name
ares_dns_parse
ares_dns_pton
ares_dns_rcode_tostr
ares_dns_rec_type_fromstr
ares_dns_rec_type_tostr
ares_dns_record_create
ares_dns_record_destroy
ares_dns_record_duplicate
ares_dns_record_get_flags
ares_dns_record_get_id
ares_dns_record_get_opcode
ares_dns_record_get_rcode
ares_dns_record_query_add
ares_dns_record_query_cnt
ares_dns_record_query_get
ares_dns_record_query_set_name
ares_dns_record_query_set_type
ares_dns_record_rr_add
ares_dns_record_rr_cnt
ares_dns_record_rr_del
ares_dns_record_rr_get
ares_dns_record_rr_get_const
ares_dns_record_set_id
ares_dns_rr_add_abin
ares_dns_rr_del_abin
ares_dns_rr_del_opt_byid
ares_dns_rr_get_abin
ares_dns_rr_get_abin_cnt
ares_dns_rr_get_addr
ares_dns_rr_get_addr6
ares_dns_rr_get_bin
ares_dns_rr_get_class
ares_dns_rr_get_keys
ares_dns_rr_get_name
ares_dns_rr_get_opt
ares_dns_rr_get_opt_byid
ares_dns_rr_get_opt_cnt
ares_dns_rr_get_str
ares_dns_rr_get_ttl
ares_dns_rr_get_type
ares_dns_rr_get_u16
ares_dns_rr_get_u32
ares_dns_rr_get_u8
ares_dns_rr_key_datatype
ares_dns_rr_key_to_rec_type
ares_dns_rr_key_tostr
ares_dns_rr_set_addr
ares_dns_rr_set_addr6
ares_dns_rr_set_bin
ares_dns_rr_set_opt
ares_dns_rr_set_str
ares_dns_rr_set_u16
ares_dns_rr_set_u32
ares_dns_rr_set_u8
ares_dns_section_tostr
ares_dns_write
ares_dup
ares_expand_name
ares_expand_string
ares_fds
ares_free_data
ares_free_hostent
ares_free_string
ares_freeaddrinfo
ares_get_servers
ares_get_servers_csv
ares_get_servers_ports
ares_getaddrinfo
ares_gethostbyaddr
ares_gethostbyname
ares_gethostbyname_file
ares_getnameinfo
ares_getsock
ares_inet_ntop
ares_inet_pton
ares_init
ares_init_options
ares_library_cleanup
ares_library_init
ares_library_init_mem
ares_library_initialized
ares_mkquery
ares_parse_a_reply
ares_parse_aaaa_reply
ares_parse_caa_reply
ares_parse_mx_reply
ares_parse_naptr_reply
ares_parse_ns_reply
ares_parse_ptr_reply
ares_parse_soa_reply
ares_parse_srv_reply
ares_parse_txt_reply
ares_parse_txt_reply_ext
ares_parse_uri_reply
ares_process
ares_process_fd
ares_query
ares_query_dnsrec
ares_queue_active_queries
ares_queue_wait_empty
ares_reinit
ares_save_options
ares_search
ares_search_dnsrec
ares_send
ares_send_dnsrec
ares_set_local_dev
ares_set_local_ip4
ares_set_local_ip6
ares_set_server_state_callback
ares_set_servers
ares_set_servers_csv
ares_set_servers_ports
ares_set_servers_ports_csv
ares_set_socket_callback
ares_set_socket_configure_callback
ares_set_socket_functions
ares_set_sortlist
ares_strerror
ares_threadsafety
ares_timeout
ares_version

Sections

.text
Size: 169KB - Virtual size: 168KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 304B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 208B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cffabfa1c5e6518ea78fd9ab55afbaac

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

iphlpapi

kernel32

msvcrt

ws2_32

Exports

Exports

Sections

.text Size: 169KB - Virtual size: 168KB

.data Size: 512B - Virtual size: 176B

.rdata Size: 15KB - Virtual size: 15KB

.pdata Size: 7KB - Virtual size: 7KB

.xdata Size: 7KB - Virtual size: 6KB

.bss Size: - Virtual size: 304B

.edata Size: 4KB - Virtual size: 3KB

.idata Size: 4KB - Virtual size: 4KB

.CRT Size: 512B - Virtual size: 88B

.tls Size: 512B - Virtual size: 16B

.rsrc Size: 1024B - Virtual size: 1008B

.reloc Size: 512B - Virtual size: 208B

.text
Size: 169KB - Virtual size: 168KB

.data
Size: 512B - Virtual size: 176B

.rdata
Size: 15KB - Virtual size: 15KB

.pdata
Size: 7KB - Virtual size: 7KB

.xdata
Size: 7KB - Virtual size: 6KB

.bss
Size: - Virtual size: 304B

.edata
Size: 4KB - Virtual size: 3KB

.idata
Size: 4KB - Virtual size: 4KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 16B

.rsrc
Size: 1024B - Virtual size: 1008B

.reloc
Size: 512B - Virtual size: 208B