9456197d0f8b6cabfea5f02ffb0176dd

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2016-Dec-20 01:13:50

Plugin Output

Info Cryptographic algorithms detected in the binary: Uses constants related to SHA256
Uses constants related to SHA512
Uses constants related to AES
Microsoft's Cryptography API
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
Can access the registry:
  • RegOpenKeyExA
  • RegCloseKey
  • RegQueryValueExW
Possibly launches other programs:
  • CreateProcessA
Uses Microsoft's cryptographic API:
  • CryptBinaryToStringA
  • CryptStringToBinaryA
  • CryptAcquireContextA
  • CryptGenRandom
  • CryptReleaseContext
Can create temporary files:
  • CreateFileA
  • GetTempPathA
  • CreateFileW
Manipulates other processes:
  • OpenProcess
Malicious VirusTotal score: 26/68 (Scanned on 2019-06-23 06:39:51) FireEye: Generic.mg.9456197d0f8b6cab
McAfee: RDN/Generic.dx
Alibaba: Trojan:Win64/LightNeuron.d09fad7b
Cyren: W64/Trojan.CSTY-2755
Symantec: Trojan.Gen.MBT
ESET-NOD32: a variant of Win64/Turla.CC
Avast: Win64:Trojan-gen
Kaspersky: Trojan.Win64.LightNeuron.b
AegisLab: Trojan.Win64.LightNeuron.4!c
Tencent: Win64.Trojan.Lightneuron.Hryk
McAfee-GW-Edition: RDN/Generic.dx
Sophos: Mal/Generic-S
Avira: BDS/Turla.muasi
Fortinet: W32/LightNeuron.B!tr
Endgame: malicious (high confidence)
Microsoft: Trojan:Win32/Casdet!rfn
ZoneAlarm: Trojan.Win64.LightNeuron.b
TACHYON: Trojan/W64.LightNeuron.261120
MAX: malware (ai score=99)
Cylance: Unsafe
TrendMicro-HouseCall: Trojan.Win64.TURLA.AA
Rising: Trojan.Turla!8.1C8 (CLOUD)
Ikarus: Trojan.Win64.Turla
GData: Win64.Trojan.Agent.09DLKK
AVG: Win64:Trojan-gen
Qihoo-360: Win32/Trojan.068

Hashes

MD5 9456197d0f8b6cabfea5f02ffb0176dd
SHA1 3c687c72a949015d5e8017c65fc4966a3b004b48
SHA256 cffac1039659857f410f5069751c6cc1c8aa413daecb27d50d85e29c5636ef63
SHA3 f1e87585f6e05b1d9090f9ecf7a0d15641ad7a1988947772d1b75be9e95366ae
SSDeep 3072:UQ6oSQbSpwwkGwLGqPAQdfSFc0DgP0GqN99XC/7p2yYcrKVihO2ylCa:UNxHyFLrNfSFcmghqH+IyDDoga
Imports Hash 0a533f7d790aa836bf3658c3fc4557d7

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xe8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 5
TimeDateStamp 2016-Dec-20 01:13:50
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 9.0
SizeOfCode 0x2ca00
SizeOfInitializedData 0x19400
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000001000 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x180000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.2
ImageVersion 0.0
SubsystemVersion 5.2
Win32VersionValue 0
SizeOfImage 0x49000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 20f8f8d3fdb2322ba2bda02abcacad9a
SHA1 e6960a2fad63fed5b8a7b3876400fb516a60c7ce
SHA256 251dc1bee0eef13db51754ef71b36de0e847b2a5973ae00af044f5db990add0a
SHA3 fcec31c7842f504fa5ffaff763e11bcd2bf2108f438f0f94253f8b4f801375f3
VirtualSize 0x2c8b1
VirtualAddress 0x1000
SizeOfRawData 0x2ca00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.23681

.rdata

MD5 459b672db079c20493c93dbd52b79801
SHA1 86881effa257ccb44bf75532d009e7d5b9e92de1
SHA256 098d099982ae5822ff72e7ae3433882123bd3a10e0160c03634154863ddf31e4
SHA3 87ecd8ec1fb4796fe87558a10055c6ae647b13eb3f41dd86fad18eb48267f0c9
VirtualSize 0x84ec
VirtualAddress 0x2e000
SizeOfRawData 0x8600
PointerToRawData 0x2ce00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.51581

.data

MD5 a5d1de2eaacbe224b3682da1d4dac129
SHA1 6d441bfeaac14f16fd01cd1db1084a8d5a62f1d0
SHA256 279b2909589a7c80ff6242d1c09fbb3707db636f76ba652219feaa780e4a4462
SHA3 6ec15d3cf2886eecec9971e31c9e070bc591f0b643dfdb8904df7cf1948e87f5
VirtualSize 0xdc48
VirtualAddress 0x37000
SizeOfRawData 0x7800
PointerToRawData 0x35400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.26984

.pdata

MD5 61ddf7298413018b2af6a392854c43ae
SHA1 b6bb74c3d5ec3e18d702805441b503d54a3195c1
SHA256 0a5d1bde707e51aa446aa8e74360122fd56c8573fa560a9bb6cda8e9c9246628
SHA3 1d13c8e7c43d2af2adb219af24a1d7aeb13ce28d7dff1684018f702aeb601b89
VirtualSize 0x27f0
VirtualAddress 0x45000
SizeOfRawData 0x2800
PointerToRawData 0x3cc00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.53274

.reloc

MD5 2e64a1f7d8ea7fb4a6f8aff4876d5765
SHA1 cb36daea52a061246e24b5967a5be7d1b4e6ed5f
SHA256 e5dbec8122a79c7fc73adf38554e9e50c371fdaa202b4c67c2762815120faafb
SHA3 a0cc3a597cf0b62d09d50c24f16adf32a8900510029cd7f29e6bc2d989c19747
VirtualSize 0x78e
VirtualAddress 0x48000
SizeOfRawData 0x800
PointerToRawData 0x3f400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 3.76555

Imports

CRYPT32.dll CryptBinaryToStringA
CryptStringToBinaryA
PSAPI.DLL QueryWorkingSet
ADVAPI32.dll RegOpenKeyExA
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
RegCloseKey
RegQueryValueExW
KERNEL32.dll RtlUnwindEx
CreateFileA
SetFilePointer
lstrlenA
HeapAlloc
HeapFree
GetProcessHeap
WriteFile
GetTimeZoneInformation
GetLocalTime
CloseHandle
SetEvent
InitializeCriticalSection
TerminateThread
Sleep
CreateEventA
LeaveCriticalSection
GetFileAttributesA
ExitThread
FindFirstFileA
GetLastError
EnterCriticalSection
FindClose
LoadLibraryA
OpenEventA
FindNextFileA
DeleteCriticalSection
DeleteFileA
CreateThread
lstrcatA
GetProcAddress
GetModuleFileNameA
GetModuleHandleA
GetTempPathA
lstrcpyA
lstrcmpA
GetSystemDirectoryA
lstrlenW
GetTickCount
WaitForSingleObject
GetSystemInfo
OpenProcess
GetCurrentProcessId
MapViewOfFile
CreateFileMappingA
GetFileSize
UnmapViewOfFile
CreateProcessA
SetHandleInformation
CreatePipe
ReadFile
PeekNamedPipe
TerminateProcess
GetExitCodeProcess
MultiByteToWideChar
GetComputerNameW
GlobalFree
FreeLibrary
GetACP
lstrcmpiA
IsDBCSLeadByteEx
WideCharToMultiByte
GetCPInfo
IsValidCodePage
HeapReAlloc
GetStdHandle
GetCurrentDirectoryA
CreateFileW
CreateDirectoryA
SetFileTime
GetFileTime
GetFullPathNameA
CreateMutexA
ReleaseMutex
USER32.dll wvsprintfA
wsprintfA
OemToCharA
CharLowerA
CharLowerW
CharUpperA
IsCharAlphaA
IsCharAlphaNumericA
wvsprintfW

Delayed Imports

FL

Ordinal 1
Address 0x1040

SV

Ordinal 2
Address 0x1050

BLE

Ordinal 3
Address 0xbf60

Version Info

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0x62acddf0
Unmarked objects 0
ASM objects (VS2008 SP1 build 30729) 1
Imports (VS2012 build 50727 / VS2005 build 50727) 11
Total imports 93
C objects (VS2008 SP1 build 30729) 49
138 (VS2008 SP1 build 30729) 4
Exports (VS2008 SP1 build 30729) 1
Resource objects (VS2008 SP1 build 30729) 1

Errors

<-- -->