6975a5be3d1ac08a2a2a5f8272a4cb996a23671f868f02fa9d2e12abaf0f6fe0

Sharing

Copy URL Twitter E-mail

General

Target

6975a5be3d1ac08a2a2a5f8272a4cb996a23671f868f02fa9d2e12abaf0f6fe0
Size

123KB
MD5

62cf905047faddced127bab6decf8470
SHA1

45101538751b63d1e61bd67dfdbb5df02eddf67e
SHA256

6975a5be3d1ac08a2a2a5f8272a4cb996a23671f868f02fa9d2e12abaf0f6fe0
SHA512

a75bda02d9284b61ce1c82917c7f94472e432625bfff5bb5bb3cc175f68f9a95386f8211acd92c8eb6a500a87802fd0d825f3c9555bca005286c563ad377375b
SSDEEP

3072:SiDfdAKuUuyRRMNnJKGjCUa0voey9POqb8hoJ:SMfdqUuyReJKJzb8h

Score

N/A

Malware Config

Signatures

Files

6975a5be3d1ac08a2a2a5f8272a4cb996a23671f868f02fa9d2e12abaf0f6fe0
.dll windows x86

d7f1902c34fa4ec9cc9d8c23b594e9f3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlInitAnsiString
NtQueryVirtualMemory
wcschr
wcsncpy
wcsncmp
RtlCreateUnicodeString
RtlUpcaseUnicodeString
wcsncat
RtlInitString
RtlxAnsiStringToUnicodeSize
RtlAnsiStringToUnicodeString
NtDuplicateObject
RtlNtStatusToDosError
RtlCompareUnicodeString
RtlGetNtProductType
RtlInitializeResource
NlsMbCodePageTag
RtlxUnicodeStringToAnsiSize
RtlUnicodeStringToAnsiString
RtlAllocateHeap
RtlFreeHeap
RtlAcquireResourceShared
RtlEqualUnicodeString
RtlDeleteResource
RtlAcquireResourceExclusive
RtlReleaseResource
NtQueryEvent
NtFreeVirtualMemory
RtlDeleteCriticalSection
memmove
RtlEnterCriticalSection
RtlLeaveCriticalSection
RtlInitializeCriticalSection
RtlCreateUnicodeStringFromAsciiz
RtlFreeUnicodeString
ZwReplyWaitReplyPort
wcslen
RtlCopyUnicodeString
ZwClose
ZwRequestWaitReplyPort
NtOpenThreadToken
NtSetInformationThread
RtlInitUnicodeString
NtOpenEvent
NtWaitForSingleObject
NtClose
strncpy
ZwConnectPort
RtlUnwind
ZwFreeVirtualMemory

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
LoadLibraryA
InterlockedCompareExchange
GetLastError
GetModuleHandleW
GetComputerNameW
GetCurrentThread
TlsSetValue
lstrlenA
lstrcpyA
SearchPathW
CreateFileW
GetFileTime
CloseHandle
GetSystemTimeAsFileTime
LoadLibraryW
GetSystemInfo
GetProcAddress
FreeLibrary
DisableThreadLibraryCalls
TlsFree
TlsAlloc
LocalReAlloc
LocalFree
LocalAlloc
SetLastError
TlsGetValue
DelayLoadFailureHook

advapi32

LsaOpenPolicy
LsaQueryInformationPolicy
LsaFreeMemory
LsaClose
RegCreateKeyExW
RegSetValueExW
SystemFunction035
RegDeleteKeyW
RegEnumValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegCloseKey

Exports

Exports

AcceptSecurityContext
AcquireCredentialsHandleA
AcquireCredentialsHandleW
AddCredentialsA
AddCredentialsW
AddSecurityPackageA
AddSecurityPackageW
ApplyControlToken
CompleteAuthToken
CredMarshalTargetInfo
CredUnmarshalTargetInfo
DecryptMessage
DeleteSecurityContext
DeleteSecurityPackageA
DeleteSecurityPackageW
EncryptMessage
EnumerateSecurityPackagesA
EnumerateSecurityPackagesW
ExportSecurityContext
FreeContextBuffer
FreeCredentialsHandle
GetComputerObjectNameA
GetComputerObjectNameW
GetSecurityUserInfo
GetUserNameExA
GetUserNameExW
ImpersonateSecurityContext
ImportSecurityContextA
ImportSecurityContextW
InitSecurityInterfaceA
InitSecurityInterfaceW
InitializeSecurityContextA
InitializeSecurityContextW
LsaCallAuthenticationPackage
LsaConnectUntrusted
LsaDeregisterLogonProcess
LsaEnumerateLogonSessions
LsaFreeReturnBuffer
LsaGetLogonSessionData
LsaLogonUser
LsaLookupAuthenticationPackage
LsaRegisterLogonProcess
LsaRegisterPolicyChangeNotification
LsaUnregisterPolicyChangeNotification
MakeSignature
QueryContextAttributesA
QueryContextAttributesW
QueryCredentialsAttributesA
QueryCredentialsAttributesW
QuerySecurityContextToken
QuerySecurityPackageInfoA
QuerySecurityPackageInfoW
RevertSecurityContext
SaslAcceptSecurityContext
SaslEnumerateProfilesA
SaslEnumerateProfilesW
SaslGetContextOption
SaslGetProfilePackageA
SaslGetProfilePackageW
SaslIdentifyPackageA
SaslIdentifyPackageW
SaslInitializeSecurityContextA
SaslInitializeSecurityContextW
SaslSetContextOption
SealMessage
SecCacheSspiPackages
SecDeleteUserModeContext
SecInitUserModeContext
SecpFreeMemory
SecpSetIPAddress
SecpTranslateName
SecpTranslateNameEx
SetContextAttributesA
SetContextAttributesW
SetCredentialsAttributesA
SetCredentialsAttributesW
TranslateNameA
TranslateNameW
UnsealMessage
VerifySignature

Sections

.text
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 61KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d7f1902c34fa4ec9cc9d8c23b594e9f3

Headers

File Characteristics

Imports

ntdll

kernel32

advapi32

Exports

Exports

Sections

.text Size: 56KB - Virtual size: 56KB

.data Size: 61KB - Virtual size: 62KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 56KB - Virtual size: 56KB

.data
Size: 61KB - Virtual size: 62KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 2KB