cecbed8d797acea95b8f6fce667c21ba09e94abea39485272541fffcbb28a36d

Sharing

Copy URL Twitter E-mail

General

Target

cecbed8d797acea95b8f6fce667c21ba09e94abea39485272541fffcbb28a36d
Size

150KB
MD5

48c6e5e4e499eab07cda719daf876da6
SHA1

3f23a4646c643f836b8385ec649edc10173a8de9
SHA256

cecbed8d797acea95b8f6fce667c21ba09e94abea39485272541fffcbb28a36d
SHA512

be50e2b57be1bf63f15953d2f9dc82ee97f648b3ac8434eea99f64c6f42fc9a8210286f417faf79bcbe237153f13d0dcb97f30a51af0ff0bc373bd3edd66a988
SSDEEP

3072:DdCwvMmgtJMnrT2/aqOlufOKNn4+r/J0faFVW0mxBoBxRopvKIvEH:DbzHIBrFVW0mx8e

Score

N/A

Malware Config

Signatures

Files

cecbed8d797acea95b8f6fce667c21ba09e94abea39485272541fffcbb28a36d
.dll windows x86

3bf2a7adbefa5027c42f925d3a7cd637

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_wcsicmp
memmove
free
_initterm
_adjust_fdiv
malloc
isdigit
_strnicmp
strrchr
wcscpy
wcschr
strncpy
_ltoa
strchr
_stricmp
mbstowcs
wcscat
wcscmp
wcsncpy
wcslen
_except_handler3

ntdll

RtlOemToUnicodeN
RtlUnicodeToOemN
RtlGetNtProductType
RtlAllocateHeap
RtlFreeHeap
RtlLengthSid
RtlCopyUnicodeString
RtlCopySid
RtlUnicodeStringToOemString
RtlOemStringToUnicodeString
RtlxUnicodeStringToOemSize
NlsMbOemCodePageTag
RtlSubAuthoritySid
RtlInitializeSid
RtlLengthRequiredSid
RtlQueryTimeZoneInformation
RtlInitAnsiString
RtlxOemStringToUnicodeSize
RtlInitString
RtlCompareMemory
RtlInitUnicodeString
NtOpenThreadToken
NtSetInformationThread
NtQuerySystemTime
RtlTimeToSecondsSince1970
RtlNtStatusToDosError
RtlTimeFieldsToTime
NtClose
NtFsControlFile
NtCreateFile
NtImpersonateAnonymousToken

netapi32

I_NetAccountDeltas
I_NetAccountSync
NetApiBufferFree
NetConnectionEnum
NetFileClose
NetFileEnum
NetFileGetInfo
NetGroupAdd
NetGroupAddUser
NetGroupDel
NetGroupDelUser
NetGroupEnum
NetGroupGetInfo
NetGroupGetUsers
NetGroupSetInfo
NetGroupSetUsers
NetGetDCName
I_NetServerAuthenticate
I_NetServerPasswordSet
I_NetServerReqChallenge
I_NetLogonUasLogoff
I_NetLogonUasLogon
NetMessageBufferSend
NetMessageNameAdd
NetMessageNameDel
NetMessageNameEnum
NetMessageNameGetInfo
I_NetNameCanonicalize
I_NetNameCompare
I_NetNameValidate
I_NetPathCanonicalize
I_NetPathCompare
I_NetPathType
NetapipBufferAllocate
NetSessionDel
NetSessionEnum
NetShareAdd
NetShareCheck
NetShareDel
NetShareEnum
NetShareGetInfo
NetShareSetInfo
NetServerDiskEnum
NetServerGetInfo
NetServerSetInfo
NetServerEnum
NetServerEnumEx
NetStatisticsGet
NetServiceControl
NetServiceEnum
NetServiceGetInfo
NetServiceInstall
NetUseAdd
NetUseDel
NetUseEnum
NetUseGetInfo
NetUserModalsGet
NetUserSetInfo
NetUserAdd
NetUserDel
NetUserEnum
NetUserGetInfo
NetUserModalsSet
NetUserSetGroups
NetWkstaGetInfo
NetWkstaSetInfo
NetApiBufferAllocate
NetUserGetGroups

kernel32

GetProcAddress
LoadLibraryW
GlobalAlloc
GlobalFree
GetComputerNameExW
GetLastError
GetTimeZoneInformation
LocalReAlloc
DisableThreadLibraryCalls
Sleep
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
GetSystemDirectoryW
LocalFree
GetLocalTime
GetTickCount
GetComputerNameA
LocalAlloc

netrap

RapConvertSingleEntry
RapAuxDataCount
RapAsciiToDecimal
RapParmNumDescriptor
RapLastPointerOffset
RapAuxDataCountOffset
RapStructureAlignment
RapGetFieldSize
RapArrayLength
RapTotalSize
RapConvertSingleEntryEx
RapStructureSize

samlib

SamLookupNamesInDomain
SamFreeMemory
SamCloseHandle
SamConnect
SamiOemChangePasswordUser2
SamiChangePasswordUser
SamiLmChangePasswordUser
SamOpenUser
SamLookupDomainInSamServer
SamOpenDomain

advapi32

LsaOpenPolicy
LsaQueryInformationPolicy
LsaClose
LsaFreeMemory
SystemFunction006
SystemFunction017
RevertToSelf

browser

I_BrowserServerEnumForXactsrv

Exports

Exports

XsCaptureParameters
XsCheckSmbDescriptor
XsConvertServerEnumBuffer
XsDupStrToWStr
XsDupWStrToStr
XsI_NetNameCanonicalize
XsI_NetNameCompare
XsI_NetNameValidate
XsI_NetPathCanonicalize
XsI_NetPathCompare
XsI_NetPathType
XsNetAccessAdd
XsNetAccessDel
XsNetAccessEnum
XsNetAccessGetInfo
XsNetAccessGetUserPerms
XsNetAccessSetInfo
XsNetAccountDeltas
XsNetAccountSync
XsNetBuildGetInfo
XsNetCharDevControl
XsNetCharDevEnum
XsNetCharDevGetInfo
XsNetCharDevQEnum
XsNetCharDevQGetInfo
XsNetCharDevQPurge
XsNetCharDevQPurgeSelf
XsNetCharDevQSetInfo
XsNetConnectionEnum
XsNetFileClose2
XsNetFileEnum2
XsNetFileGetInfo2
XsNetGetDCName
XsNetGroupAdd
XsNetGroupAddUser
XsNetGroupDel
XsNetGroupDelUser
XsNetGroupEnum
XsNetGroupGetInfo
XsNetGroupGetUsers
XsNetGroupSetInfo
XsNetGroupSetUsers
XsNetLogonEnum
XsNetMessageBufferSend
XsNetMessageNameAdd
XsNetMessageNameDel
XsNetMessageNameEnum
XsNetMessageNameGetInfo
XsNetPrintDestAdd
XsNetPrintDestControl
XsNetPrintDestDel
XsNetPrintDestEnum
XsNetPrintDestGetInfo
XsNetPrintDestSetInfo
XsNetPrintJobContinue
XsNetPrintJobDel
XsNetPrintJobEnum
XsNetPrintJobGetInfo
XsNetPrintJobPause
XsNetPrintJobSetInfo
XsNetPrintQAdd
XsNetPrintQContinue
XsNetPrintQDel
XsNetPrintQEnum
XsNetPrintQGetInfo
XsNetPrintQPause
XsNetPrintQPurge
XsNetPrintQSetInfo
XsNetRemoteTOD
XsNetServerAuthenticate
XsNetServerDiskEnum
XsNetServerEnum2
XsNetServerEnum3
XsNetServerGetInfo
XsNetServerPasswordSet
XsNetServerReqChallenge
XsNetServerSetInfo
XsNetServiceControl
XsNetServiceEnum
XsNetServiceGetInfo
XsNetServiceInstall
XsNetSessionDel
XsNetSessionEnum
XsNetSessionGetInfo
XsNetShareAdd
XsNetShareCheck
XsNetShareDel
XsNetShareEnum
XsNetShareGetInfo
XsNetShareSetInfo
XsNetStatisticsGet2
XsNetUnsupportedApi
XsNetUseAdd
XsNetUseDel
XsNetUseEnum
XsNetUseGetInfo
XsNetUserAdd2
XsNetUserDel
XsNetUserEnum
XsNetUserEnum2
XsNetUserGetGroups
XsNetUserGetInfo
XsNetUserModalsGet
XsNetUserModalsSet
XsNetUserPasswordSet2
XsNetUserSetGroups
XsNetUserSetInfo
XsNetUserSetInfo2
XsNetWkstaGetInfo
XsNetWkstaSetInfo
XsNetWkstaSetUID
XsNetWkstaUserLogoff
XsNetWkstaUserLogon
XsSamOEMChangePasswordUser2_P
XsSetParameters

Sections

.text
Size: 83KB - Virtual size: 82KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3bf2a7adbefa5027c42f925d3a7cd637

Headers

File Characteristics

Imports

msvcrt

ntdll

netapi32

kernel32

netrap

samlib

advapi32

browser

Exports

Exports

Sections

.text Size: 83KB - Virtual size: 82KB

.data Size: 61KB - Virtual size: 61KB

.rsrc Size: 1024B - Virtual size: 1024B

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 83KB - Virtual size: 82KB

.data
Size: 61KB - Virtual size: 61KB

.rsrc
Size: 1024B - Virtual size: 1024B

.reloc
Size: 3KB - Virtual size: 3KB