1ab8ba4155afb374f2e6b490969f61413e0fa53ed3ce80bd8ddeba7acf2d921b

Sharing

Copy URL Twitter E-mail

General

Target

1ab8ba4155afb374f2e6b490969f61413e0fa53ed3ce80bd8ddeba7acf2d921b
Size

139KB
MD5

4972e348aeca991f4700a7bd6b11e2a0
SHA1

c303e07b92017f545a2a4a8bbd5121ad3adedfcd
SHA256

1ab8ba4155afb374f2e6b490969f61413e0fa53ed3ce80bd8ddeba7acf2d921b
SHA512

46699181f850ef5f4e87453b6ddd2f6216b32282433192cb6001a9769caa634d73c6da6f80a921b210dee55690f3b2033f2c3f6f90074ab082c629f0264ffb0e
SSDEEP

3072:FYHo6fLQMDeWVq7I+NcsES35j1GkLIavDYu3puRjkTRNklPZ0cB3:FYHo6jgW4CS35RLY+0ERNklPma

Score

N/A

Malware Config

Signatures

Files

1ab8ba4155afb374f2e6b490969f61413e0fa53ed3ce80bd8ddeba7acf2d921b
.exe windows x86

fb687f4f7acc1f20b5382a2c932a259e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyW
LsaClose
GetSidSubAuthority
CopySid
GetSidLengthRequired
GetSidSubAuthorityCount
LsaFreeMemory
EqualSid
LsaLookupSids
GetLengthSid
LsaQueryInformationPolicy
LsaOpenPolicy
LsaLookupNames2
LsaLookupNames
SetSecurityDescriptorDacl
LookupAccountNameW
AddAccessAllowedAce
InitializeAcl
InitializeSecurityDescriptor
CreateWellKnownSid
LookupAccountSidW
GetAce
GetSecurityDescriptorDacl
GetServiceKeyNameW
OpenSCManagerW
GetServiceDisplayNameW
CloseServiceHandle
EnumDependentServicesW
QueryServiceStatus
OpenServiceW

kernel32

GetComputerNameExW
Sleep
CompareStringW
GetUserDefaultLCID
GetCommandLineW
GetStdHandle
SetThreadUILanguage
GetCPInfo
GetConsoleOutputCP
GetLastError
HeapSetInformation
WideCharToMultiByte
GetComputerNameW
LocalFree
LocalAlloc
GetDriveTypeW
GetTimeFormatW
GetDateFormatW
GetProfileStringW
SetSystemTime
SetLocalTime
GetTickCount
GetProcAddress
LoadLibraryW
GlobalAlloc
GlobalFree
lstrlenW
GetTimeZoneInformation
FreeLibrary
SetLastError
GetModuleFileNameW
WriteConsoleW
WriteFile
FormatMessageW
PeekConsoleInputW
GetConsoleMode
SetConsoleMode
ReadConsoleW
GetFileType
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
InterlockedExchange
InterlockedCompareExchange
SetUnhandledExceptionFilter
GetModuleHandleA
GetComputerNameA

msvcrt

_snwprintf_s
putchar
_local_unwind4
_wcsdup
wcstok
_vsnwprintf_s
_ftol2
_ftol2_sse
wcstod
_strnicmp
_stricmp
wcspbrk
strchr
_controlfp
_except_handler4_common
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_XcptFilter
_exit
__getmainargs
memmove
wcscspn
iswctype
calloc
wcsrchr
srand
rand
_wcsrev
malloc
realloc
free
_ultow
memcpy
swprintf_s
wcsstr
wcsncat_s
wcschr
exit
sprintf_s
setlocale
_wcsnicmp
_iob
_fileno
_setmode
qsort
wcsspn
wcscpy_s
wcsncmp
memset
wcsncpy_s
_wcslwr
wcscat_s
_wcsupr
_wcsicmp
_cexit

dsrole

DsRoleFreeMemory
DsRoleGetPrimaryDomainInformation

netutils

NetpwListCanonicalize
NetpwNameCompare
NetpwListTraverse
NetApiBufferReallocate
NetpwPathType
NetpwNameCanonicalize
NetApiBufferAllocate
NetpwNameValidate
NetApiBufferFree
NetapipBufferAllocate

logoncli

DsGetDcNameW

browcli

NetServerEnum

samcli

NetUserSetInfo
NetUserEnum
NetUserGetInfo
NetGroupGetInfo
NetGroupGetUsers
NetGroupEnum
NetGroupDelUser
NetGroupAddUser
NetGroupDel
NetGroupSetInfo
NetGroupAdd
NetUserDel
NetUserAdd
NetUserModalsSet
NetUserModalsGet
NetUserGetGroups

srvcli

NetSessionEnum
NetFileClose
NetFileGetInfo
NetFileEnum
NetServerTransportEnum
NetSessionDel
NetSessionGetInfo
NetConnectionEnum
NetShareDel
NetShareEnum
NetShareSetInfo
NetShareAdd
NetShareCheck
NetShareDelSticky
NetRemoteTOD
NetServerGetInfo
NetServerSetInfo
NetShareGetInfo

wkscli

NetWkstaTransportEnum
NetUseDel
NetUseEnum
NetWkstaUserGetInfo
NetWkstaGetInfo

netapi32

NetServiceControl
NetServiceEnum
NetStatisticsGet
NetServiceInstall

samlib

SamDeleteAlias
SamCloseHandle
SamRemoveMemberFromAlias
SamFreeMemory
SamQueryInformationAlias
SamLookupIdsInDomain
SamLookupNamesInDomain
SamOpenDomain
SamConnect
SamEnumerateAliasesInDomain
SamGetMembersInAlias
SamSetInformationAlias
SamGetAliasMembership
SamCreateAliasInDomain
SamAddMemberToAlias
SamOpenAlias

ntdsapi

DsFreeNameResultW
DsCrackNamesW
DsBindW
DsUnBindW

ntdll

RtlAllocateHeap
RtlInitializeSid
RtlLengthRequiredSid
RtlSubAuthoritySid
RtlCopySid
RtlSubAuthorityCountSid
NtClose
NtQuerySystemTime
RtlNtStatusToDosError
RtlTimeFieldsToTime
NtSetInformationThread
NtAdjustPrivilegesToken
NtDuplicateToken
RtlQueryTimeZoneInformation
RtlCompareMemory
RtlxOemStringToUnicodeSize
NlsMbOemCodePageTag
RtlOemStringToUnicodeString
RtlInitAnsiString
RtlInitUnicodeString
RtlTimeToSecondsSince1970
RtlLengthSid
RtlGetNtProductType
NtOpenProcessToken
RtlInitString

Sections

.text
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 34KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

fb687f4f7acc1f20b5382a2c932a259e

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

dsrole

netutils

logoncli

browcli

samcli

srvcli

wkscli

netapi32

samlib

ntdsapi

ntdll

Sections

.text Size: 96KB - Virtual size: 96KB

.data Size: 34KB - Virtual size: 54KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 5KB - Virtual size: 8KB

.text
Size: 96KB - Virtual size: 96KB

.data
Size: 34KB - Virtual size: 54KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 8KB