0909d5e055739b2feaa6c237a10b9a40fd5c2ecd05fd2b1222db946a7292df98

Sharing

Copy URL

Twitter E-mail

General

Target

0909d5e055739b2feaa6c237a10b9a40fd5c2ecd05fd2b1222db946a7292df98
Size

191KB
MD5

c9c35017f940f148e5b7785badb4b9b7
SHA1

9c26f0a516a113679ec07539f4090b5cb76b308a
SHA256

0909d5e055739b2feaa6c237a10b9a40fd5c2ecd05fd2b1222db946a7292df98
SHA512

2498cdea19468466a03ea46708d07309b646be89b34070c674e3a332425677e2ee0217be47dbc02d5c1519e6e7e3dcae18c16f84c2cd5c203b994a922c8cfaa4

Score

N/A

Malware Config

Signatures

Files

0909d5e055739b2feaa6c237a10b9a40fd5c2ecd05fd2b1222db946a7292df98
.dll windows x86

cad2dcb0a225de0f2058f49537875a3d

Code Sign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileA
GetFileSize
SetEndOfFile
Sleep
CreateSemaphoreA
ReadFile
GetSystemDirectoryA
GetLocalTime
GetModuleFileNameA
VirtualProtect
GetFileTime
DeleteCriticalSection
CloseHandle
GetCurrentProcessId
WriteConsoleW
SetFilePointerEx
SetStdHandle
SetEnvironmentVariableA
GetConsoleMode
GetConsoleCP
FlushFileBuffers
OutputDebugStringW
GetStringTypeW
HeapReAlloc
LoadLibraryExW
GetModuleFileNameW
WriteFile
LeaveCriticalSection
EnterCriticalSection
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
GetCommandLineA
GetCurrentThreadId
RaiseException
RtlUnwind
IsDebuggerPresent
IsProcessorFeaturePresent
GetLastError
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
HeapSize
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
GetTimeZoneInformation
HeapFree
HeapAlloc
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStartupInfoW
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
CreateFileW

mswsock

GetServiceA
SetServiceA
GetAddressByNameA

comsvcs

MTSCreateActivity

ntdsapi

DsQuoteRdnValueA
DsListDomainsInSiteA
DsListServersForDomainInSiteA
DsMakePasswordCredentialsA
DsGetDomainControllerInfoA
DsListRolesA
DsIsMangledRdnValueA
DsIsMangledDnA
DsFreeSchemaGuidMapA
DsListServersInSiteA
DsListSitesA
DsMakeSpnA
DsListInfoForServerA
DsInheritSecurityIdentityA
DsGetSpnA
DsFreeSpnArrayA
DsMapSchemaGuidsA

Exports

Exports

Spelltone

Sections

.text
Size: 138KB - Virtual size: 138KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cad2dcb0a225de0f2058f49537875a3d

Code Sign

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

mswsock

comsvcs

ntdsapi

Exports

Exports

Sections

.text Size: 138KB - Virtual size: 138KB

.rdata Size: 38KB - Virtual size: 37KB

.data Size: 5KB - Virtual size: 69KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 138KB - Virtual size: 138KB

.rdata
Size: 38KB - Virtual size: 37KB

.data
Size: 5KB - Virtual size: 69KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 6KB - Virtual size: 6KB