a1949ee14fbec1892162f592517565219b3f100a030d8ad8f7e70444838689a6N

Sharing

Copy URL Twitter E-mail

General

Target

a1949ee14fbec1892162f592517565219b3f100a030d8ad8f7e70444838689a6N
Size

284KB
MD5

66e70468ea4067cb47083210e1095be0
SHA1

397de7bbd2c6f2b4ac3cd20027754c59ffafbf79
SHA256

a1949ee14fbec1892162f592517565219b3f100a030d8ad8f7e70444838689a6
SHA512

dfd2cec4667522028a2839e933b726fe2326f92adb36265e1db5ee800297f908e0333d42ede9d20dfba8deeff0abf2c97cdc10617f747a73a0d470ef609d435a
SSDEEP

6144:5N6OsVHQW4e7YNyEEVF9LHDIcwTngo6G/:5ba4nNvGrLHDIcwLglG/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a1949ee14fbec1892162f592517565219b3f100a030d8ad8f7e70444838689a6N

Files

a1949ee14fbec1892162f592517565219b3f100a030d8ad8f7e70444838689a6N
.dll windows:4 windows x86 arch:x86

8b106d0b61bb6f57f9f13261827cdcaf

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

TlsSetValue
LocalReAlloc
TlsGetValue
SetErrorMode
lstrcatA
lstrcpynA
GetVersion
SetLastError
GetLastError
GlobalFlags
WritePrivateProfileStringA
GetModuleHandleA
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetProcessVersion
GetCurrentProcess
ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
EnterCriticalSection
GetCPInfo
GetOEMCP
RtlUnwind
HeapFree
HeapAlloc
RaiseException
GetCommandLineA
ExitProcess
TerminateProcess
HeapSize
HeapReAlloc
GetACP
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
GlobalReAlloc
LeaveCriticalSection
TlsFree
GlobalHandle
GlobalUnlock
GlobalFree
DeleteCriticalSection
TlsAlloc
InitializeCriticalSection
LocalAlloc
LocalFree
CloseHandle
GetModuleFileNameA
GlobalLock
GlobalAlloc
GlobalDeleteAtom
lstrcmpA
lstrcmpiA
GetCurrentThread
GetCurrentThreadId
MultiByteToWideChar
WideCharToMultiByte
InterlockedDecrement
InterlockedIncrement
lstrlenA
Sleep
GetTickCount
GetVersionExA
LoadLibraryA
GetSystemDirectoryA
GetProcAddress
FreeLibrary
lstrcpyA

advapi32

RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegOpenKeyExA

wsock32

getservbyname
htonl
WSASetLastError
ioctlsocket
gethostname
inet_addr
WSACleanup
WSAStartup
ntohs
gethostbyname
htons
sendto
recvfrom
select
getservbyport
setsockopt
inet_ntoa
gethostbyaddr
closesocket
socket
WSAGetLastError
bind

comctl32

ord17

user32

wsprintfA
GetMenuItemCount
GetDC
ReleaseDC
TabbedTextOutA
DrawTextA
GrayStringA
GetDlgItem
SetWindowLongA
SetWindowPos
ShowWindow
SetFocus
GetSystemMetrics
GetWindowPlacement
IsIconic
SystemParametersInfoA
RegisterWindowMessageA
SetForegroundWindow
GetForegroundWindow
GetMessagePos
GetMessageTime
DefWindowProcA
RemovePropA
CallWindowProcA
GetPropA
SetPropA
GetClassLongA
CreateWindowExA
DestroyWindow
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
GetClientRect
AdjustWindowRectEx
GetSysColor
MapWindowPoints
LoadIconA
LoadCursorA
GetSysColorBrush
DestroyMenu
GetWindowTextA
SetWindowTextA
ClientToScreen
GetWindow
GetDlgCtrlID
GetWindowRect
PtInRect
GetClassNameA
LoadStringA
UnregisterClassA
UnhookWindowsHookEx
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
GetKeyState
CallNextHookEx
ValidateRect
PeekMessageA
GetCursorPos
SetWindowsHookExA
GetParent
GetLastActivePopup
IsWindowEnabled
GetWindowLongA
MessageBoxA
EnableWindow
SetCursor
SendMessageA
PostMessageA
PostQuitMessage
IsWindowVisible

gdi32

SetTextColor
DeleteObject
DeleteDC
SetBkColor
GetStockObject
SelectObject
RestoreDC
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetDeviceCaps
GetObjectA
CreateBitmap
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
SaveDC

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

Exports

Exports

BroadCastLoad
BroadCastLoadBind
GetBroadCastSize
GetBroadCastValue
GetError_Idx
GetError_Sts
GetIP
GetMyIPAddress
GetSetMIBs
GetSetMIBsV6
GetValue
GetValueEx
GetValuesEx
Get_VersionInfo
Init
Init2
Load
LoadEx
OidMessClear
QuickLoad
Quit
SetAddress
SetAddressInfo
SetIP2
SetOidMess
SetOperation
SetWaitTime
WinsockClose
WinsockStart
gmain
gmain2
gmain2_timeout
snmp_init

Sections

.text
Size: 116KB - Virtual size: 114KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

8b106d0b61bb6f57f9f13261827cdcaf

Headers

File Characteristics

Imports

kernel32

advapi32

wsock32

comctl32

user32

gdi32

winspool.drv

Exports

Exports

Sections

.text Size: 116KB - Virtual size: 114KB

.rdata Size: 20KB - Virtual size: 17KB

.data Size: 16KB - Virtual size: 43KB

.rsrc Size: 4KB - Virtual size: 1016B

.reloc Size: 16KB - Virtual size: 12KB

.text Size: 108KB - Virtual size: 108KB

.text
Size: 116KB - Virtual size: 114KB

.rdata
Size: 20KB - Virtual size: 17KB

.data
Size: 16KB - Virtual size: 43KB

.rsrc
Size: 4KB - Virtual size: 1016B

.reloc
Size: 16KB - Virtual size: 12KB

.text
Size: 108KB - Virtual size: 108KB