70ee865c1795a08a4ae30a487b689f26fcf6d2036939c1027c325a21be1dc632

Sharing

Copy URL Twitter E-mail

General

Target

70ee865c1795a08a4ae30a487b689f26fcf6d2036939c1027c325a21be1dc632
Size

166KB
MD5

0b5627977e187cb82603aad4e917c280
SHA1

dd5db057fee8e0c398da982687d0858eafa08117
SHA256

70ee865c1795a08a4ae30a487b689f26fcf6d2036939c1027c325a21be1dc632
SHA512

135d9f3d87bea8c8b07aeeb92501bfa6db5363f694b3c9875fceaa7b6e20b9f18207059a3dead92b2a0d8feaec2d9bc30b49e49d488c53f1b99d380e5d3fed1d
SSDEEP

3072:IYHo6fLQMDeWVq7I+NcsES35j1GkLIavDYu3puRjkTRNklPo0cBwQClZdKhk:IYHo6jgW4CS35RLY+0ERNklPtXQqdt

Score

N/A

Malware Config

Signatures

Files

70ee865c1795a08a4ae30a487b689f26fcf6d2036939c1027c325a21be1dc632
.exe windows x86

fb687f4f7acc1f20b5382a2c932a259e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyW
LsaClose
GetSidSubAuthority
CopySid
GetSidLengthRequired
GetSidSubAuthorityCount
LsaFreeMemory
EqualSid
LsaLookupSids
GetLengthSid
LsaQueryInformationPolicy
LsaOpenPolicy
LsaLookupNames2
LsaLookupNames
SetSecurityDescriptorDacl
LookupAccountNameW
AddAccessAllowedAce
InitializeAcl
InitializeSecurityDescriptor
CreateWellKnownSid
LookupAccountSidW
GetAce
GetSecurityDescriptorDacl
GetServiceKeyNameW
OpenSCManagerW
GetServiceDisplayNameW
CloseServiceHandle
EnumDependentServicesW
QueryServiceStatus
OpenServiceW

kernel32

GetComputerNameExW
Sleep
CompareStringW
GetUserDefaultLCID
GetCommandLineW
GetStdHandle
SetThreadUILanguage
GetCPInfo
GetConsoleOutputCP
GetLastError
HeapSetInformation
WideCharToMultiByte
GetComputerNameW
LocalFree
LocalAlloc
GetDriveTypeW
GetTimeFormatW
GetDateFormatW
GetProfileStringW
SetSystemTime
SetLocalTime
GetTickCount
GetProcAddress
LoadLibraryW
GlobalAlloc
GlobalFree
lstrlenW
GetTimeZoneInformation
FreeLibrary
SetLastError
GetModuleFileNameW
WriteConsoleW
WriteFile
FormatMessageW
PeekConsoleInputW
GetConsoleMode
SetConsoleMode
ReadConsoleW
GetFileType
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
InterlockedExchange
InterlockedCompareExchange
SetUnhandledExceptionFilter
GetModuleHandleA
GetComputerNameA

msvcrt

_snwprintf_s
putchar
_local_unwind4
_wcsdup
wcstok
_vsnwprintf_s
_ftol2
_ftol2_sse
wcstod
_strnicmp
_stricmp
wcspbrk
strchr
_controlfp
_except_handler4_common
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_XcptFilter
_exit
__getmainargs
memmove
wcscspn
iswctype
calloc
wcsrchr
srand
rand
_wcsrev
malloc
realloc
free
_ultow
memcpy
swprintf_s
wcsstr
wcsncat_s
wcschr
exit
sprintf_s
setlocale
_wcsnicmp
_iob
_fileno
_setmode
qsort
wcsspn
wcscpy_s
wcsncmp
memset
wcsncpy_s
_wcslwr
wcscat_s
_wcsupr
_wcsicmp
_cexit

dsrole

DsRoleFreeMemory
DsRoleGetPrimaryDomainInformation

netutils

NetpwListCanonicalize
NetpwNameCompare
NetpwListTraverse
NetApiBufferReallocate
NetpwPathType
NetpwNameCanonicalize
NetApiBufferAllocate
NetpwNameValidate
NetApiBufferFree
NetapipBufferAllocate

logoncli

DsGetDcNameW

browcli

NetServerEnum

samcli

NetUserSetInfo
NetUserEnum
NetUserGetInfo
NetGroupGetInfo
NetGroupGetUsers
NetGroupEnum
NetGroupDelUser
NetGroupAddUser
NetGroupDel
NetGroupSetInfo
NetGroupAdd
NetUserDel
NetUserAdd
NetUserModalsSet
NetUserModalsGet
NetUserGetGroups

srvcli

NetSessionEnum
NetFileClose
NetFileGetInfo
NetFileEnum
NetServerTransportEnum
NetSessionDel
NetSessionGetInfo
NetConnectionEnum
NetShareDel
NetShareEnum
NetShareSetInfo
NetShareAdd
NetShareCheck
NetShareDelSticky
NetRemoteTOD
NetServerGetInfo
NetServerSetInfo
NetShareGetInfo

wkscli

NetWkstaTransportEnum
NetUseDel
NetUseEnum
NetWkstaUserGetInfo
NetWkstaGetInfo

netapi32

NetServiceControl
NetServiceEnum
NetStatisticsGet
NetServiceInstall

samlib

SamDeleteAlias
SamCloseHandle
SamRemoveMemberFromAlias
SamFreeMemory
SamQueryInformationAlias
SamLookupIdsInDomain
SamLookupNamesInDomain
SamOpenDomain
SamConnect
SamEnumerateAliasesInDomain
SamGetMembersInAlias
SamSetInformationAlias
SamGetAliasMembership
SamCreateAliasInDomain
SamAddMemberToAlias
SamOpenAlias

ntdsapi

DsFreeNameResultW
DsCrackNamesW
DsBindW
DsUnBindW

ntdll

RtlAllocateHeap
RtlInitializeSid
RtlLengthRequiredSid
RtlSubAuthoritySid
RtlCopySid
RtlSubAuthorityCountSid
NtClose
NtQuerySystemTime
RtlNtStatusToDosError
RtlTimeFieldsToTime
NtSetInformationThread
NtAdjustPrivilegesToken
NtDuplicateToken
RtlQueryTimeZoneInformation
RtlCompareMemory
RtlxOemStringToUnicodeSize
NlsMbOemCodePageTag
RtlOemStringToUnicodeString
RtlInitAnsiString
RtlInitUnicodeString
RtlTimeToSecondsSince1970
RtlLengthSid
RtlGetNtProductType
NtOpenProcessToken
RtlInitString

Sections

.text
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 34KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

fpllcdk
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

fb687f4f7acc1f20b5382a2c932a259e

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

dsrole

netutils

logoncli

browcli

samcli

srvcli

wkscli

netapi32

samlib

ntdsapi

ntdll

Sections

.text Size: 96KB - Virtual size: 95KB

.data Size: 34KB - Virtual size: 54KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 32KB - Virtual size: 33KB

fpllcdk Size: - Virtual size: 4KB

.text
Size: 96KB - Virtual size: 95KB

.data
Size: 34KB - Virtual size: 54KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 32KB - Virtual size: 33KB

fpllcdk
Size: - Virtual size: 4KB