cec3d7ca18a28fe06da8d41c6c37a4cae56da82f81198c8aa2beb02072ea8b19

Sharing

Copy URL

Twitter E-mail

General

Target

cec3d7ca18a28fe06da8d41c6c37a4cae56da82f81198c8aa2beb02072ea8b19
Size

157KB
MD5

005cc2c5cb491116bc625108ce416a20
SHA1

8a7ca66ceffa38eb475a5914ec44ee8d49a9b2f9
SHA256

cec3d7ca18a28fe06da8d41c6c37a4cae56da82f81198c8aa2beb02072ea8b19
SHA512

b9f10a0afe840a81f291e4ca8ccd24a494468c689774060713f4a49b079fcdb68b48478f56c1003c43d568f0797c1ab99fe5f5ffa8f8c2721b5d73184159a294
SSDEEP

3072:nKCJObAehhWj2vt01qSK+seixnO95VxOXFdx97/xGIFtAS9AEQWb7c2r0e9cFdwy:F2WsrMI8StQ+jq/G

Score

N/A

Malware Config

Signatures

Files

cec3d7ca18a28fe06da8d41c6c37a4cae56da82f81198c8aa2beb02072ea8b19
.exe windows x86

c18a93106ce14460df5f92809776736a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

LoadStringW
CharUpperW
wsprintfW

mpr

WNetAddConnection2W
WNetCancelConnection2W
WNetGetLastErrorW

ole32

CoInitializeSecurity
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
CoInitializeEx

oleaut32

SafeArrayGetLBound
SafeArrayGetUBound
SysAllocStringByteLen
VariantChangeType
VariantClear
VariantCopy
VariantInit
SysFreeString
SafeArrayGetElement
SysStringLen
SysAllocString

secur32

TranslateNameW
GetComputerObjectNameW
GetUserNameExW

ws2_32

WSACleanup
inet_addr
WSAGetLastError
WSAStartup
gethostbyaddr

netapi32

NetApiBufferFree
DsGetDcNameW
NetServerGetInfo

framedyn

??1CHString@@QAE@XZ
??0CHString@@QAE@XZ
?GetData@CHString@@IBEPAUCHStringData@@XZ
?Empty@CHString@@QAEXXZ
?Compare@CHString@@QBEHPBG@Z
?ReleaseBuffer@CHString@@QAEXH@Z
?GetBufferSetLength@CHString@@QAEPAGH@Z
?Format@CHString@@QAAXPBGZZ
??4CHString@@QAEABV0@ABV0@@Z
?Mid@CHString@@QBE?AV1@H@Z
?Find@CHString@@QBEHG@Z
?FindOneOf@CHString@@QBEHPBG@Z
?Left@CHString@@QBE?AV1@H@Z
??YCHString@@QAEABV0@PBG@Z
??0CHString@@QAE@PBG@Z
?Mid@CHString@@QBE?AV1@HH@Z
?Find@CHString@@QBEHPBG@Z
??0CHString@@QAE@ABV0@@Z
??H@YG?AVCHString@@ABV0@PBG@Z
?MakeLower@CHString@@QAEXXZ
?SetAt@CHString@@QAEXHG@Z
??H@YG?AVCHString@@ABV0@0@Z
?GetBuffer@CHString@@QAEPAGH@Z
??4CHString@@QAEABV0@PBG@Z

ntdsapi

DsBindWithCredW
DsUnBindW
DsFreeNameResultW
DsCrackNamesW

msvcrt

calloc
wcstok
wcslen
free
_wcsicmp
??2@YAPAXI@Z
??3@YAXPAX@Z
__CxxFrameHandler
_iob
wcstod
wcstol
wcsstr
wcsncmp
_wcsnicmp
fflush
fprintf
wcschr
strtok
_CxxThrowException
_c_exit
_exit
?terminate@@YAXXZ
_controlfp
??1type_info@@UAE@XZ
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
_initterm
__setusermatherr
__wgetmainargs
__winitenv
exit
_cexit
wcscpy
_XcptFilter
realloc

advapi32

RegCloseKey
RegQueryInfoKeyW
RegOpenKeyExW
RegConnectRegistryW
LookupAccountSidW
ConvertStringSidToSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW

kernel32

CreateMutexW
CloseHandle
GetModuleHandleA
GetConsoleMode
SetConsoleMode
GetConsoleScreenBufferInfo
GetStdHandle
SetLastError
lstrlenW
WriteConsoleW
SetConsoleCursorPosition
lstrcmpiW
lstrcpyW
lstrcmpW
InterlockedIncrement
LocalAlloc
FormatMessageW
lstrcatW
InterlockedDecrement
GetComputerNameW
GetUserDefaultLCID
ReadFile
ReadConsoleW
MultiByteToWideChar
LoadLibraryW
GetProcAddress
FreeLibrary
LocalFree
GetLastError
OpenMutexW
GetTimeFormatW
lstrcpynW
WideCharToMultiByte
VerSetConditionMask
VerifyVersionInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetComputerNameExW
WaitForSingleObject
ReleaseMutex
FileTimeToLocalFileTime
FileTimeToSystemTime
GetLocalTime
GetDateFormatW

Sections

.text
Size: 95KB - Virtual size: 94KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 21B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 60KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

cztazlp
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

c18a93106ce14460df5f92809776736a

Headers

DLL Characteristics

File Characteristics

Imports

user32

mpr

ole32

oleaut32

secur32

ws2_32

netapi32

framedyn

ntdsapi

msvcrt

advapi32

kernel32

Sections

.text Size: 95KB - Virtual size: 94KB

.data Size: 512B - Virtual size: 176B

.tls Size: 512B - Virtual size: 21B

.rsrc Size: 60KB - Virtual size: 61KB

cztazlp Size: - Virtual size: 4KB

.text
Size: 95KB - Virtual size: 94KB

.data
Size: 512B - Virtual size: 176B

.tls
Size: 512B - Virtual size: 21B

.rsrc
Size: 60KB - Virtual size: 61KB

cztazlp
Size: - Virtual size: 4KB