73a166e9f57140629a8de8c75901b4428b79284bfcdc5e193d489f9c5a01b6f9N

Sharing

Copy URL Twitter E-mail

General

Target

73a166e9f57140629a8de8c75901b4428b79284bfcdc5e193d489f9c5a01b6f9N
Size

48KB
MD5

0994a87031ede0cfcfa7eeab028f47f0
SHA1

97209a962a15b728b32a46cc4001d6d46fb287ca
SHA256

73a166e9f57140629a8de8c75901b4428b79284bfcdc5e193d489f9c5a01b6f9
SHA512

19a36b0b29d646047c42ada5a905d396ef29ad5253cb707c0e46fe2079bfafdde86a9e77356b14e1ad730ca11e1ee5971d3acce731813337861834c1f4d5b4d4
SSDEEP

1536:bQ0qMvMDuQrHZemxqtjQxfHqEq6hPuW4zlDf:bQ0vMDuWHgmUklKENhPu3zlDf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/wlbsprov.dll

Files

73a166e9f57140629a8de8c75901b4428b79284bfcdc5e193d489f9c5a01b6f9N
.cab
wlbsprov.dll
.dll regsvr32 windows:5 windows x86 arch:x86

43685ec43dad44d0a47c10bc6795b6c0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

wlbsprov.pdb

Imports

msvcrt

_except_handler3
?terminate@@YAXXZ
malloc
_onexit
__dllonexit
??1type_info@@UAE@XZ
_adjust_fdiv
_initterm
free
iswspace
wcstol
swscanf
_vsnwprintf
wcsncpy
??3@YAXPAX@Z
??2@YAPAXI@Z
__CxxFrameHandler
_CxxThrowException
wcslen
_wcsicmp
_wtol
_purecall
_ltow

msvcp60

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBG@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z
??1_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ

kernel32

GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc
GetCurrentThread
WideCharToMultiByte
CloseHandle
GetLastError
GetModuleFileNameW
Sleep
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedIncrement
InterlockedDecrement
LocalFree

advapi32

GetTraceEnableFlags
TraceMessage
RegSetValueExW
RegCloseKey
RegQueryValueExW
RegCreateKeyExW
RegOpenKeyExW
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
RegCreateKeyW
RegDeleteKeyW
RegOpenKeyW
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
PrivilegeCheck
OpenThreadToken
LookupPrivilegeValueW

oleaut32

SysFreeString
VariantInit
SysAllocString
VariantCopy
VariantChangeType
VariantClear

ole32

CoImpersonateClient
StringFromGUID2

wlbsctrl

WlbsSetRemotePassword
WlbsGetPortRule
WlbsEnumPortRules
WlbsDeletePortRule
WlbsAddPortRule
?GetClusterIpOrIndex@CWlbsCluster@@QAEKPAVCWlbsControl@@@Z
WlbsSetDefaults
?WlbsCodeSet@CWlbsControl@@QAEXKK@Z
?GetPassword@CWlbsCluster@@QAEKXZ
?EnumClusterObjects@CWlbsControl@@QAEKAAPAPAVCWlbsCluster@@PAK@Z
?WlbsTimeoutSet@CWlbsControl@@QAEXKK@Z
?Initialize@CWlbsControl@@QAEKXZ
?ReInitialize@CWlbsControl@@QAE_NXZ
?WlbsDisable@CWlbsControl@@QAEKKKPAUWLBS_RESPONSE@@PAKKK@Z
?WlbsEnable@CWlbsControl@@QAEKKKPAUWLBS_RESPONSE@@PAKKK@Z
?WlbsDrain@CWlbsControl@@QAEKKKPAUWLBS_RESPONSE@@PAKKK@Z
?CommitChanges@CWlbsCluster@@QAEKPAVCWlbsControl@@@Z
?WlbsResume@CWlbsControl@@QAEKKKPAUWLBS_RESPONSE@@PAK@Z
?WlbsStart@CWlbsControl@@QAEKKKPAUWLBS_RESPONSE@@PAK@Z
?WlbsStop@CWlbsControl@@QAEKKKPAUWLBS_RESPONSE@@PAK@Z
?WlbsSuspend@CWlbsControl@@QAEKKKPAUWLBS_RESPONSE@@PAK@Z
WlbsGetSpecifiedClusterMember
?WlbsQuery@CWlbsControl@@QAEKPAVCWlbsCluster@@KPAUWLBS_RESPONSE@@PAK2P6GX1@Z@Z
?WlbsQueryState@CWlbsControl@@QAEKKKKPATNLB_OPTIONS@@PAUWLBS_RESPONSE@@PAK@Z
WlbsGetEffectiveVersion
?ReadConfig@CWlbsCluster@@QAEKPAUWLBS_REG_PARAMS@@@Z
WlbsFormatMessage
WlbsAddressToString
WlbsResolve
??1CWlbsControl@@QAE@XZ
RegOpenWlbsSetting
?GetClusterFromIpOrIndex@CWlbsControl@@QAEPAVCWlbsCluster@@K@Z
?WriteConfig@CWlbsCluster@@QAEKQAUWLBS_REG_PARAMS@@@Z
?WlbsDrainStop@CWlbsControl@@QAEKKKPAUWLBS_RESPONSE@@PAK@Z
WlbsGetNumPortRules
??0CWlbsControl@@QAE@XZ

ws2_32

inet_addr

Exports

Exports

??4CWlbsCluster@@QAEAAV0@ABV0@@Z
??4CWlbsControl@@QAEAAV0@ABV0@@Z
??4WLBS_REG_PARAMS@@QAEAAU0@ABU0@@Z
?GetAdapterGuid@CWlbsCluster@@QAEABU_GUID@@XZ
?GetClusterIp@CWlbsCluster@@QAEKXZ
?GetClusterNum@CWlbsControl@@QAEKXZ
?GetDedicatedIp@CWlbsCluster@@QAEKXZ
?GetDriverHandle@CWlbsControl@@QAEPAXXZ
?GetHostID@CWlbsCluster@@QAEKXZ
?GetInitResult@CWlbsControl@@IAEKXZ
?IsCommitPending@CWlbsCluster@@QBE_NXZ
?IsInitialized@CWlbsControl@@IBE_NXZ
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

43685ec43dad44d0a47c10bc6795b6c0

Headers

File Characteristics

PDB Paths

Imports

msvcrt

msvcp60

kernel32

advapi32

oleaut32

ole32

wlbsctrl

ws2_32

Exports

Exports

Sections

.text Size: 120KB - Virtual size: 120KB

.data Size: 2KB - Virtual size: 2KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 12KB - Virtual size: 11KB

.text
Size: 120KB - Virtual size: 120KB

.data
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 12KB - Virtual size: 11KB