24723640080b00ae3559ef0eed5c7e758e4de18de565bba559773adae9d06b3d

Sharing

Copy URL

Twitter E-mail

General

Target

24723640080b00ae3559ef0eed5c7e758e4de18de565bba559773adae9d06b3d
Size

937KB
MD5

60ffca2508b6894b0d851a7ee4922d1b
SHA1

acc1ebf7c2306d467b2deeed67fa98650c210a50
SHA256

24723640080b00ae3559ef0eed5c7e758e4de18de565bba559773adae9d06b3d
SHA512

7c6e7f9476c7e9e804260545496f8d286f9355280402911af8017dfb462f495a4db7d49750fa1bb654d890885dad0512ca6e10dd528c04d3ee7314af57466b9e
SSDEEP

24576:rwXm6vU3VbjWPaoWRGtmjBNsSVGdlVi+7t:rwXm6vUVb3oyCmVNsSyVZ

Score

N/A

Malware Config

Signatures

Files

24723640080b00ae3559ef0eed5c7e758e4de18de565bba559773adae9d06b3d
.exe windows x86

994f59afdfbed0844abf85af2048c908

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

dnsapi

DnsDhcpSrvRegisterTerm
DnsValidateName_UTF8
DnsStatusString
DnsDhcpSrvRegisterInit
DnsQuery_W
DnsQuery_UTF8

ntdsapi

DsMakeSpnW
DsBindWithCredW
DsQuoteRdnValueW
DsUnBindW
DsMapSchemaGuidsW
DsBindW
DsGetDomainControllerInfoW
DsMakePasswordCredentialsW
DsCrackSpnW
DsFreeNameResultW
DsFreeDomainControllerInfoW

netapi32

NetUserSetInfo
NetShareCheck
NetServerGetInfo
NetValidateName
NetGroupSetInfo
DsGetDcNameWithAccountW
NetUserDel
NetShareDel
NetGroupDelUser
NetShareDelSticky

kernel32

GetPrivateProfileIntA
LoadLibraryExW
VirtualAlloc
CreateMailslotW
SetInformationJobObject
_lread
ContinueDebugEvent
GlobalLock
GetStdHandle
SetThreadExecutionState
SetEvent
CreateTimerQueueTimer
OpenFileMappingA

advapi32

GetTraceEnableLevel
LsaEnumerateTrustedDomains
SystemFunction005
RegNotifyChangeKeyValue
GetKernelObjectSecurity
GetSidSubAuthorityCount
AddAccessAllowedAce
ConvertStringSidToSidA
LookupAccountNameW
SetKernelObjectSecurity
RegQueryValueExA
GetSidSubAuthority
CryptHashData
GetUserNameA
SystemFunction018
IsTokenRestricted
CreateProcessAsUserA

Sections

.text
Size: 195KB - Virtual size: 194KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 145KB - Virtual size: 206KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 116KB - Virtual size: 193KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: 88KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 95KB - Virtual size: 174KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 123KB - Virtual size: 153KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 67KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 102KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

994f59afdfbed0844abf85af2048c908

Headers

DLL Characteristics

File Characteristics

Imports

dnsapi

ntdsapi

netapi32

kernel32

advapi32

Sections

.text Size: 195KB - Virtual size: 194KB

.itext Size: 145KB - Virtual size: 206KB

.data Size: 116KB - Virtual size: 193KB

.bss Size: 88KB - Virtual size: 118KB

.idata Size: 95KB - Virtual size: 174KB

.tls Size: 123KB - Virtual size: 153KB

.rdata Size: 67KB - Virtual size: 126KB

.rsrc Size: 102KB - Virtual size: 102KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 195KB - Virtual size: 194KB

.itext
Size: 145KB - Virtual size: 206KB

.data
Size: 116KB - Virtual size: 193KB

.bss
Size: 88KB - Virtual size: 118KB

.idata
Size: 95KB - Virtual size: 174KB

.tls
Size: 123KB - Virtual size: 153KB

.rdata
Size: 67KB - Virtual size: 126KB

.rsrc
Size: 102KB - Virtual size: 102KB

.reloc
Size: 2KB - Virtual size: 2KB