4653d0b5609c1efcc3f3c205d12e81d30e92ebf495bd2bae895893610c7248d9

Sharing

Copy URL Twitter E-mail

General

Target

4653d0b5609c1efcc3f3c205d12e81d30e92ebf495bd2bae895893610c7248d9
Size

400KB
MD5

658f89561824a7ecc4f321976312b5e0
SHA1

64cdebe3a9fbe16fe574ab5091074dab9cb92c18
SHA256

4653d0b5609c1efcc3f3c205d12e81d30e92ebf495bd2bae895893610c7248d9
SHA512

aa45a4f0d3f1d7bc2c94e8915829e814c374493fe3ccd8255056fb170108c009a9006e66d7dffcfcc7429cb87edb6c18616a9e9add19f287e4e68d72581361cd
SSDEEP

12288:IZgGGwAX5QtHpANUOTcIm/blndHVVyupED:bdfQtHWNU9/b5xPED

Score

N/A

Malware Config

Signatures

Files

4653d0b5609c1efcc3f3c205d12e81d30e92ebf495bd2bae895893610c7248d9
.dll windows x86

6bf3d0ba6725b6d51082895f68b53a09

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msvcrt

sprintf
memset
strlen
wprintf

kernel32

VirtualQuery
GetDevicePowerState
GetTickCount
GetTimeFormatW
GetDevicePowerState

comctl32

UninitializeFlatSB
FlatSB_GetScrollInfo
InitCommonControlsEx
ord5
FlatSB_GetScrollRange
ord6
ImageList_Replace
ImageList_Copy
ImageList_Duplicate
ImageList_GetIcon
ImageList_SetIconSize
ord17
ImageList_GetDragImage
CreatePropertySheetPageA
ord3
ImageList_AddMasked
ord16
ImageList_Add
ord2
ImageList_DragShowNolock
ImageList_SetOverlayImage
FlatSB_EnableScrollBar
ImageList_DragMove
FlatSB_SetScrollProp
FlatSB_GetScrollProp

ntdsapi

DsCrackNamesW
DsBindA
DsCrackSpnW
DsReplicaAddA
DsMakePasswordCredentialsA
DsAddSidHistoryW
DsReplicaDelW
DsListSitesA
DsGetDomainControllerInfoW
DsReplicaModifyW
DsListSitesW
DsClientMakeSpnForTargetServerW
DsClientMakeSpnForTargetServerA
DsMakeSpnW
DsListServersForDomainInSiteA
DsGetSpnW
DsReplicaUpdateRefsA
DsRemoveDsDomainW
DsBindWithCredW
DsFreeSpnArrayA
DsAddSidHistoryA
DsReplicaAddW
DsFreeSpnArrayW
DsBindW
DsReplicaDelA
DsRemoveDsDomainA
DsBindWithSpnW
DsServerRegisterSpnA
DsServerRegisterSpnW
DsReplicaGetInfoW

Exports

Exports

AllocateHide
CLSIDFromCompressed
CloseConsole
CoSend
ExportDirKBSize
FoldUnicode
GopherAnimatedList
ImpersonateAccountLogRevocation
InstallSysLayout
ObjectRgnOem
RegCat
RegMkGetTopCount
SHAppUnicodeBytes
SHFileInCertificates
SHFileRChr
UnrealizeEncryptProp
VerAnonymousKBSizeHelp

Sections

.text
Size: 376KB - Virtual size: 373KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6bf3d0ba6725b6d51082895f68b53a09

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

comctl32

ntdsapi

Exports

Exports

Sections

.text Size: 376KB - Virtual size: 373KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 4KB - Virtual size: 3KB

.rsrc Size: 8KB - Virtual size: 8KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 376KB - Virtual size: 373KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 8KB - Virtual size: 8KB

.reloc
Size: 4KB - Virtual size: 4KB