2ebe95ee19d05186f1d34ed038b1ff717b010ae7142fc57041a651bfa642b421

Sharing

Copy URL Twitter E-mail

General

Target

2ebe95ee19d05186f1d34ed038b1ff717b010ae7142fc57041a651bfa642b421
Size

182KB
MD5

40405fe4e28c4725579b44650a0044d0
SHA1

447ca288dd6b8977c245202dc8f94c7590595e0b
SHA256

2ebe95ee19d05186f1d34ed038b1ff717b010ae7142fc57041a651bfa642b421
SHA512

b23ee4038d1aa2a43532f7f1b89e9fa4853eb50018c045dd55efacadf286f426a47c37fe68dda4752312e0d8e09e3f4d66bc24ab782dd6d6f29dc6306bcce807
SSDEEP

3072:gz32/b9MmVeOY7eehaMinAQRNOYl0zqfHs7MuI4KVxhXGd:g6zvq9qJN3l0+FnjxdW

Score

N/A

Malware Config

Signatures

Files

2ebe95ee19d05186f1d34ed038b1ff717b010ae7142fc57041a651bfa642b421
.exe windows x86

fb687f4f7acc1f20b5382a2c932a259e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyW
LsaClose
GetSidSubAuthority
CopySid
GetSidLengthRequired
GetSidSubAuthorityCount
LsaFreeMemory
EqualSid
LsaLookupSids
GetLengthSid
LsaQueryInformationPolicy
LsaOpenPolicy
LsaLookupNames2
LsaLookupNames
SetSecurityDescriptorDacl
LookupAccountNameW
AddAccessAllowedAce
InitializeAcl
InitializeSecurityDescriptor
CreateWellKnownSid
LookupAccountSidW
GetAce
GetSecurityDescriptorDacl
GetServiceKeyNameW
OpenSCManagerW
GetServiceDisplayNameW
CloseServiceHandle
EnumDependentServicesW
QueryServiceStatus
OpenServiceW

kernel32

GetComputerNameExW
Sleep
CompareStringW
GetUserDefaultLCID
GetCommandLineW
GetStdHandle
SetThreadUILanguage
GetCPInfo
GetConsoleOutputCP
GetLastError
HeapSetInformation
WideCharToMultiByte
GetComputerNameW
LocalFree
LocalAlloc
GetDriveTypeW
GetTimeFormatW
GetDateFormatW
GetProfileStringW
SetSystemTime
SetLocalTime
GetTickCount
GetProcAddress
LoadLibraryW
GlobalAlloc
GlobalFree
lstrlenW
GetTimeZoneInformation
FreeLibrary
SetLastError
GetModuleFileNameW
WriteConsoleW
WriteFile
FormatMessageW
PeekConsoleInputW
GetConsoleMode
SetConsoleMode
ReadConsoleW
GetFileType
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
InterlockedExchange
InterlockedCompareExchange
SetUnhandledExceptionFilter
GetModuleHandleA
GetComputerNameA

msvcrt

_snwprintf_s
putchar
_local_unwind4
_wcsdup
wcstok
_vsnwprintf_s
_ftol2
_ftol2_sse
wcstod
_strnicmp
_stricmp
wcspbrk
strchr
_controlfp
_except_handler4_common
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_XcptFilter
_exit
__getmainargs
memmove
wcscspn
iswctype
calloc
wcsrchr
srand
rand
_wcsrev
malloc
realloc
free
_ultow
memcpy
swprintf_s
wcsstr
wcsncat_s
wcschr
exit
sprintf_s
setlocale
_wcsnicmp
_iob
_fileno
_setmode
qsort
wcsspn
wcscpy_s
wcsncmp
memset
wcsncpy_s
_wcslwr
wcscat_s
_wcsupr
_wcsicmp
_cexit

dsrole

DsRoleFreeMemory
DsRoleGetPrimaryDomainInformation

netutils

NetpwListCanonicalize
NetpwNameCompare
NetpwListTraverse
NetApiBufferReallocate
NetpwPathType
NetpwNameCanonicalize
NetApiBufferAllocate
NetpwNameValidate
NetApiBufferFree
NetapipBufferAllocate

logoncli

DsGetDcNameW

browcli

NetServerEnum

samcli

NetUserSetInfo
NetUserEnum
NetUserGetInfo
NetGroupGetInfo
NetGroupGetUsers
NetGroupEnum
NetGroupDelUser
NetGroupAddUser
NetGroupDel
NetGroupSetInfo
NetGroupAdd
NetUserDel
NetUserAdd
NetUserModalsSet
NetUserModalsGet
NetUserGetGroups

srvcli

NetSessionEnum
NetFileClose
NetFileGetInfo
NetFileEnum
NetServerTransportEnum
NetSessionDel
NetSessionGetInfo
NetConnectionEnum
NetShareDel
NetShareEnum
NetShareSetInfo
NetShareAdd
NetShareCheck
NetShareDelSticky
NetRemoteTOD
NetServerGetInfo
NetServerSetInfo
NetShareGetInfo

wkscli

NetWkstaTransportEnum
NetUseDel
NetUseEnum
NetWkstaUserGetInfo
NetWkstaGetInfo

netapi32

NetServiceControl
NetServiceEnum
NetStatisticsGet
NetServiceInstall

samlib

SamDeleteAlias
SamCloseHandle
SamRemoveMemberFromAlias
SamFreeMemory
SamQueryInformationAlias
SamLookupIdsInDomain
SamLookupNamesInDomain
SamOpenDomain
SamConnect
SamEnumerateAliasesInDomain
SamGetMembersInAlias
SamSetInformationAlias
SamGetAliasMembership
SamCreateAliasInDomain
SamAddMemberToAlias
SamOpenAlias

ntdsapi

DsFreeNameResultW
DsCrackNamesW
DsBindW
DsUnBindW

ntdll

RtlAllocateHeap
RtlInitializeSid
RtlLengthRequiredSid
RtlSubAuthoritySid
RtlCopySid
RtlSubAuthorityCountSid
NtClose
NtQuerySystemTime
RtlNtStatusToDosError
RtlTimeFieldsToTime
NtSetInformationThread
NtAdjustPrivilegesToken
NtDuplicateToken
RtlQueryTimeZoneInformation
RtlCompareMemory
RtlxOemStringToUnicodeSize
NlsMbOemCodePageTag
RtlOemStringToUnicodeString
RtlInitAnsiString
RtlInitUnicodeString
RtlTimeToSecondsSince1970
RtlLengthSid
RtlGetNtProductType
NtOpenProcessToken
RtlInitString

Sections

.text
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 50KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

kjmgwnr
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

fb687f4f7acc1f20b5382a2c932a259e

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

dsrole

netutils

logoncli

browcli

samcli

srvcli

wkscli

netapi32

samlib

ntdsapi

ntdll

Sections

.text Size: 96KB - Virtual size: 96KB

.data Size: 50KB - Virtual size: 54KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 32KB - Virtual size: 33KB

kjmgwnr Size: - Virtual size: 4KB

.text
Size: 96KB - Virtual size: 96KB

.data
Size: 50KB - Virtual size: 54KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 32KB - Virtual size: 33KB

kjmgwnr
Size: - Virtual size: 4KB