1722a99da590267229b6874dca76c2e17fdf7e1bc7edc91410e07510bef8bc38

Sharing

Copy URL Twitter E-mail

General

Target

1722a99da590267229b6874dca76c2e17fdf7e1bc7edc91410e07510bef8bc38
Size

534KB
MD5

42f42a218429025fd1ab9d463559a2a0
SHA1

75857e3df3b9773acbd87cbdbe785d56cecee3d3
SHA256

1722a99da590267229b6874dca76c2e17fdf7e1bc7edc91410e07510bef8bc38
SHA512

15d1a3e74f49dd36755058586aa84fd5538b95529244d6244b6eb0afe94a503b0a17199309dbbd5ba5a1d47579b8c21f05dce3d0dff94f05ca038c9bfcf0f0f0
SSDEEP

12288:f3+4+GhUPNtBl6t1zRLBUvYKGkdclZOIfLfnlbJgZ4MecPRmy:f3+4+GePNtBl6t1zRLBUvVdczOSlbJgL

Score

N/A

Malware Config

Signatures

Files

1722a99da590267229b6874dca76c2e17fdf7e1bc7edc91410e07510bef8bc38
.exe windows x64

ca23a6513bf06aa60f664ff57f92626d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

ExitProcess
GetModuleHandleW
GetSystemDirectoryW
LoadLibraryW
FormatMessageW
GetLastError
Sleep
HeapFree
HeapAlloc
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
OutputDebugStringA
SetThreadUILanguage
WriteFile
WideCharToMultiByte
GetConsoleOutputCP
GetStdHandle
GetProcessHeap

msvcrt

_snprintf
_itoa
malloc
_fmode
__badioinfo
__pioinfo
isleadbyte
_fileno
_lseeki64
_write
_isatty
_commode
__setusermatherr
_amsg_exit
_initterm
exit
_cexit
_exit
_XcptFilter
__C_specific_handler
__mb_cur_max
mbtowc
?terminate@@YAXXZ
memset
memcpy
__set_app_type
__wgetmainargs
fwprintf
_errno
_vsnwprintf
_wcsnicmp
calloc
_wcsicmp
towupper
_iob
fprintf
free
wcschr
ferror
_wsetlocale

netapi32

DsGetDcNameWithAccountW
NetApiBufferFree

ntdsapi

DsUnBindW
DsBindW
DsWriteAccountSpnW
DsFreeNameResultW
DsCrackNamesW

wldap32

ord46
ord12
ord191
ord97
ord145
ord206
ord135
ord88
ord133
ord224
ord27
ord16
ord13
ord147
ord167
ord208
ord140
ord26
ord41
ord127
ord170
ord73
ord118

user32

LoadStringW

shlwapi

StrChrW
StrCmpW

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlInitUnicodeString

Sections

.text
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 636B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.vmp0
Size: 500KB - Virtual size: 1.8MB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ca23a6513bf06aa60f664ff57f92626d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

netapi32

ntdsapi

wldap32

user32

shlwapi

ntdll

Sections

.text Size: 27KB - Virtual size: 27KB

.data Size: 1KB - Virtual size: 5KB

.pdata Size: 1024B - Virtual size: 636B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 276B

.vmp0 Size: 500KB - Virtual size: 1.8MB

.text
Size: 27KB - Virtual size: 27KB

.data
Size: 1KB - Virtual size: 5KB

.pdata
Size: 1024B - Virtual size: 636B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 276B

.vmp0
Size: 500KB - Virtual size: 1.8MB