144984d78e576a764185ca246c42dd3e1deeca98e258f935b779b6f8ae767364

Sharing

Copy URL Twitter E-mail

General

Target

144984d78e576a764185ca246c42dd3e1deeca98e258f935b779b6f8ae767364
Size

695KB
MD5

693427cf63c6800a4fcd7f4490a6cb50
SHA1

b59759540adb12e32a899df4e81e135ef0c4e0b8
SHA256

144984d78e576a764185ca246c42dd3e1deeca98e258f935b779b6f8ae767364
SHA512

fb2d4f896ff6e8040475f37c6473d9b8101673ed671a89ce60510849a61725326f9c51986415d7eed108359941a843349c817295509081b8b954edde00c8d5c1
SSDEEP

12288:y6qBN3l0IhjFyjxLNyP4AIh/SvgQKCkce0SGTsKJE/Ehv85:47l0OyNNxA2/z4e0NsgE/Ep8

Score

N/A

Malware Config

Signatures

Files

144984d78e576a764185ca246c42dd3e1deeca98e258f935b779b6f8ae767364
.exe windows x86

fb687f4f7acc1f20b5382a2c932a259e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyW
LsaClose
GetSidSubAuthority
CopySid
GetSidLengthRequired
GetSidSubAuthorityCount
LsaFreeMemory
EqualSid
LsaLookupSids
GetLengthSid
LsaQueryInformationPolicy
LsaOpenPolicy
LsaLookupNames2
LsaLookupNames
SetSecurityDescriptorDacl
LookupAccountNameW
AddAccessAllowedAce
InitializeAcl
InitializeSecurityDescriptor
CreateWellKnownSid
LookupAccountSidW
GetAce
GetSecurityDescriptorDacl
GetServiceKeyNameW
OpenSCManagerW
GetServiceDisplayNameW
CloseServiceHandle
EnumDependentServicesW
QueryServiceStatus
OpenServiceW

kernel32

GetComputerNameExW
Sleep
CompareStringW
GetUserDefaultLCID
GetCommandLineW
GetStdHandle
SetThreadUILanguage
GetCPInfo
GetConsoleOutputCP
GetLastError
HeapSetInformation
WideCharToMultiByte
GetComputerNameW
LocalFree
LocalAlloc
GetDriveTypeW
GetTimeFormatW
GetDateFormatW
GetProfileStringW
SetSystemTime
SetLocalTime
GetTickCount
GetProcAddress
LoadLibraryW
GlobalAlloc
GlobalFree
lstrlenW
GetTimeZoneInformation
FreeLibrary
SetLastError
GetModuleFileNameW
WriteConsoleW
WriteFile
FormatMessageW
PeekConsoleInputW
GetConsoleMode
SetConsoleMode
ReadConsoleW
GetFileType
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
InterlockedExchange
InterlockedCompareExchange
SetUnhandledExceptionFilter
GetModuleHandleA
GetComputerNameA

msvcrt

_snwprintf_s
putchar
_local_unwind4
_wcsdup
wcstok
_vsnwprintf_s
_ftol2
_ftol2_sse
wcstod
_strnicmp
_stricmp
wcspbrk
strchr
_controlfp
_except_handler4_common
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_XcptFilter
_exit
__getmainargs
memmove
wcscspn
iswctype
calloc
wcsrchr
srand
rand
_wcsrev
malloc
realloc
free
_ultow
memcpy
swprintf_s
wcsstr
wcsncat_s
wcschr
exit
sprintf_s
setlocale
_wcsnicmp
_iob
_fileno
_setmode
qsort
wcsspn
wcscpy_s
wcsncmp
memset
wcsncpy_s
_wcslwr
wcscat_s
_wcsupr
_wcsicmp
_cexit

dsrole

DsRoleFreeMemory
DsRoleGetPrimaryDomainInformation

netutils

NetpwListCanonicalize
NetpwNameCompare
NetpwListTraverse
NetApiBufferReallocate
NetpwPathType
NetpwNameCanonicalize
NetApiBufferAllocate
NetpwNameValidate
NetApiBufferFree
NetapipBufferAllocate

logoncli

DsGetDcNameW

browcli

NetServerEnum

samcli

NetUserSetInfo
NetUserEnum
NetUserGetInfo
NetGroupGetInfo
NetGroupGetUsers
NetGroupEnum
NetGroupDelUser
NetGroupAddUser
NetGroupDel
NetGroupSetInfo
NetGroupAdd
NetUserDel
NetUserAdd
NetUserModalsSet
NetUserModalsGet
NetUserGetGroups

srvcli

NetSessionEnum
NetFileClose
NetFileGetInfo
NetFileEnum
NetServerTransportEnum
NetSessionDel
NetSessionGetInfo
NetConnectionEnum
NetShareDel
NetShareEnum
NetShareSetInfo
NetShareAdd
NetShareCheck
NetShareDelSticky
NetRemoteTOD
NetServerGetInfo
NetServerSetInfo
NetShareGetInfo

wkscli

NetWkstaTransportEnum
NetUseDel
NetUseEnum
NetWkstaUserGetInfo
NetWkstaGetInfo

netapi32

NetServiceControl
NetServiceEnum
NetStatisticsGet
NetServiceInstall

samlib

SamDeleteAlias
SamCloseHandle
SamRemoveMemberFromAlias
SamFreeMemory
SamQueryInformationAlias
SamLookupIdsInDomain
SamLookupNamesInDomain
SamOpenDomain
SamConnect
SamEnumerateAliasesInDomain
SamGetMembersInAlias
SamSetInformationAlias
SamGetAliasMembership
SamCreateAliasInDomain
SamAddMemberToAlias
SamOpenAlias

ntdsapi

DsFreeNameResultW
DsCrackNamesW
DsBindW
DsUnBindW

ntdll

RtlAllocateHeap
RtlInitializeSid
RtlLengthRequiredSid
RtlSubAuthoritySid
RtlCopySid
RtlSubAuthorityCountSid
NtClose
NtQuerySystemTime
RtlNtStatusToDosError
RtlTimeFieldsToTime
NtSetInformationThread
NtAdjustPrivilegesToken
NtDuplicateToken
RtlQueryTimeZoneInformation
RtlCompareMemory
RtlxOemStringToUnicodeSize
NlsMbOemCodePageTag
RtlOemStringToUnicodeString
RtlInitAnsiString
RtlInitUnicodeString
RtlTimeToSecondsSince1970
RtlLengthSid
RtlGetNtProductType
NtOpenProcessToken
RtlInitString

Sections

.text
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 50KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.vmp1
Size: 540KB - Virtual size: 1.6MB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

fb687f4f7acc1f20b5382a2c932a259e

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

dsrole

netutils

logoncli

browcli

samcli

srvcli

wkscli

netapi32

samlib

ntdsapi

ntdll

Sections

.text Size: 96KB - Virtual size: 96KB

.data Size: 50KB - Virtual size: 54KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 5KB - Virtual size: 5KB

.vmp1 Size: 540KB - Virtual size: 1.6MB

.text
Size: 96KB - Virtual size: 96KB

.data
Size: 50KB - Virtual size: 54KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 5KB

.vmp1
Size: 540KB - Virtual size: 1.6MB