Sample details: 4b2d33b818f53377620ac159e9f8a613 --

Hashes
MD5: 4b2d33b818f53377620ac159e9f8a613
SHA1: 8cdcd90b16152d5d1010d2b80134071da71a8896
SHA256: abb23f737fb077b738186d99c528cc6377a36593668d6e758112e61e46df74d1
SSDEEP: 192:Z7kSEVtnVEUNu2LdBdjZ257wNOEFegEFn3HkaM3w2K/COyudCy:WSEznVbg2B27wNOYegEFn3pM3w/COyu
Details
File Type: MS-DOS
Yara Hits
YRP/Microsoft_Visual_Cpp_v60_DLL_additional | YRP/Microsoft_Visual_Cpp | YRP/IsPE32 | YRP/IsWindowsGUI | YRP/HasModified_DOS_Message | YRP/domain | YRP/contentis_base64 | YRP/System_Tools | YRP/win_registry | YRP/MD5_Constants | YRP/QuarianCode | YRP/Quarian | FlorianRoth/DragonFly_APT_Sep17_3 |
Strings
		t7VWWWj
?XDSNu_
WPWWWWWWWW
VPVj@Vj
tyVVVj
mpsi.dll
memset
memcpy
_snwprintf
memcmp
_snprintf
strlen
strcpy
ntdll.dll
CreateTimerQueueTimer
DeleteTimerQueueTimer
CreateEventA
InitializeCriticalSection
VirtualFree
CloseHandle
WaitForSingleObject
CreateThread
VirtualAlloc
LoadLibraryA
GetProcAddress
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW
GetCurrentProcessId
IsBadReadPtr
LeaveCriticalSection
EnterCriticalSection
InterlockedIncrement
SetEvent
InterlockedDecrement
GetFileAttributesExW
ExpandEnvironmentStringsW
OpenMutexW
TerminateProcess
ResumeThread
QueueUserAPC
CreateFileMappingW
GetModuleHandleA
CreateProcessW
GetStartupInfoW
DeleteCriticalSection
KERNEL32.dll
RegCloseKey
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
ADVAPI32.dll
SendARP
iphlpapi.dll
malloc
MSVCRT.dll
/libexec/core.sdb
/www/core.sdb
/bin/i386/kernelbase.bin
/%04x/brp.exe
.shared
/libexec/setup.exe
ntdll.dll
ZwMapViewOfSection
/bin/i386/netscan.bin
/status
/sc.bin
/libexec/sc.bin
3:4?4a4p4
5(5A5F5S5]5e5u5
6&696[6b6p6
8(8.838b8q8
9,:6:M:U:
:";.;6;<;A;W;
<#<J<c<s<}<
<J=U=h=
>!>`>k>r>x>
0^0f0p0
1%11181G1U1^1o1
4"4(4/464;4@4[4e4l4q4~4
F144:4@4F4L4R4X4^4d4j4p4v4