bc0a0e563e9b4cd5492e91a55abb1444e14b6679d87c429675566460ecf4a613

Sharing

Copy URL Twitter E-mail

General

Target

bc0a0e563e9b4cd5492e91a55abb1444e14b6679d87c429675566460ecf4a613
Size

455KB
MD5

0b31a82a6afb25596dac19268fb03530
SHA1

b04a26ef620bbdde2d8679f8e903a767aad9275d
SHA256

bc0a0e563e9b4cd5492e91a55abb1444e14b6679d87c429675566460ecf4a613
SHA512

8bf955a7ec913a935dc7a45c21e422b518cb773ec6f3b9e48f4018095fce64530a1018bb1eeec0e7814d7d2e614364f4b0ce6ee563bdd59897458b4568a8bae7
SSDEEP

12288:SA530CkzHnQS6QoWc7jSxY3JIMA23d0+Mkdm1oX4y:SA53PkzwHQoYwIkicgy

Score

N/A

Malware Config

Signatures

Files

bc0a0e563e9b4cd5492e91a55abb1444e14b6679d87c429675566460ecf4a613
.dll windows x86

834a5664c9eedd80b1cdfa211751270f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

AllocateAndInitializeSid
LookupAccountSidA
FreeSid
RegQueryInfoKeyW
OpenThreadToken
AccessCheck
RegisterEventSourceW
ReportEventW
DeregisterEventSource
RegConnectRegistryW
RegisterTraceGuidsW
TraceEvent
GetTraceLoggerHandle
CryptGenRandom
SystemFunction033
SystemFunction032
RevertToSelf
SystemFunction004
RegDeleteValueW
RegSetValueExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
LsaOpenPolicy
LsaQueryInformationPolicy
LsaFreeMemory
LsaEnumerateTrustedDomains
LsaClose
RegisterServiceCtrlHandlerW
RegNotifyChangeKeyValue
CryptAcquireContextW
QueryServiceConfigW
QueryServiceStatus
RegDeleteKeyA
I_ScSetServiceBitsW
SystemFunction007
SystemFunction031
RegOpenKeyW
RegQueryValueExW
RegOpenKeyExW
RegDeleteKeyW
SystemFunction001
SystemFunction002
SystemFunction012
SystemFunction014
SystemFunction013
SystemFunction015
UnregisterTraceGuids
CryptReleaseContext
SetServiceStatus
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
OpenSCManagerW
OpenServiceW
CloseServiceHandle
RegCreateKeyExA
GetSidLengthRequired

cryptdll

CDLocateCSystem
CDLocateCheckSum

dnsapi

DnsQuery_W
DnsValidateName_W
DnsNameCompare_UTF8
DnsNameCompare_W
DnsReplaceRecordSetUTF8
DnsModifyRecordsInSet_UTF8
DnsGetLastFailedUpdateInfo
DnsQuery_UTF8
DnsRecordListFree
DnsValidateName_UTF8

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
GetModuleHandleW
GetModuleFileNameW
CreateMailslotA
CreateSemaphoreW
GetVersionExW
GetCurrentProcess
GetCurrentThread
DuplicateHandle
ReleaseSemaphore
QueueUserWorkItem
lstrcmpA
lstrcatA
lstrlenA
lstrcpyA
SetComputerNameExW
FormatMessageW
ExpandEnvironmentStringsW
GetThreadLocale
lstrcpyW
LoadLibraryA
GetLocalTime
GetFileAttributesW
CreateDirectoryW
SetFilePointer
GetComputerNameW
WaitForMultipleObjects
LoadLibraryExW
GetProcAddress
OpenEventW
RegisterWaitForSingleObject
MoveFileW
DisableThreadLibraryCalls
DeviceIoControl
GetOverlappedResult
UnregisterWaitEx
SetMailslotInfo
CompareStringW
WideCharToMultiByte
MultiByteToWideChar
GetTickCount
DeleteFileW
LocalReAlloc
GetComputerNameExW
GetFileSize
ReadFile
LocalAlloc
WriteFile
FlushFileBuffers
CreateFileW
DeleteCriticalSection
LocalFree
InitializeCriticalSection
CreateEventW
ResetEvent
CreateThread
FreeLibrary
GetSystemWindowsDirectoryW
Sleep
WaitForSingleObject
CloseHandle
GetSystemTimeAsFileTime
SetEvent
GetLastError
EnterCriticalSection
LeaveCriticalSection

lsasrv

LsaIUpdateForestTrustInformation
LsaIQuerySiteInfo
LsaIFree_LSAP_SITE_INFO
LsaIOpenPolicyTrusted
LsarQueryInformationPolicy
LsaISafeMode
LsaIFree_LSAPR_POLICY_INFORMATION
LsarClose
LsaIUnregisterAllPolicyChangeNotificationCallback
LsaIRegisterPolicyChangeNotificationCallback
LsaIGetForestTrustInformation
LsaIFilterSids
LsaIFreeReturnBuffer
LsaICallPackagePassthrough
LsaIFreeHeap
LsaIGetNbAndDnsDomainNames
LsaIFree_LSAPR_SR_SECURITY_DESCRIPTOR
LsarQuerySecurityObject
LsaIFree_LSAPR_TRUSTED_DOMAIN_INFO
LsarQueryInfoTrustedDomain
LsarOpenTrustedDomain
LsaIFree_LSAPR_PRIVILEGE_SET
LsaIFree_LSAPR_UNICODE_STRING
LsarLookupPrivilegeName
LsarGetSystemAccessAccount
LsarEnumeratePrivilegesAccount
LsarOpenAccount
LsaIFree_LSAPR_CR_CIPHER_VALUE
LsarQuerySecret
LsarOpenSecret
LsarQueryTrustedDomainInfoByName
LsarSetSecret
LsarSetTrustedDomainInfoByName
LsaISetSerialNumberPolicy
LsaIGetSerialNumberPolicy
LsaINotifyNetlogonParametersChangeW
LsaIIsDsPaused
LsaIFree_LSAP_SITENAME_INFO
LsaIFree_LSAP_SUBNET_INFO
LsaIQuerySubnetInfo
LsaIGetSiteName
LsaICallPackage
LsaIFree_LSAI_SECRET_ENUM_BUFFER
LsaIFree_LSAPR_TRUSTED_ENUM_BUFFER
LsaIFree_LSAPR_ACCOUNT_ENUM_BUFFER
LsaIEnumerateSecrets
LsarEnumerateTrustedDomains
LsarEnumerateAccounts
LsaISetClientDnsHostName
LsarSetInformationPolicy
LsaIFree_LSAPR_UNICODE_STRING_BUFFER
LsaIForestTrustFindMatch
LsaIFreeForestTrustInfo
LsaIQueryForestTrustInfo
LsarEnumerateTrustedDomainsEx
LsaIFree_LSAPR_TRUSTED_ENUM_BUFFER_EX
LsarOpenPolicy

msv1_0

MsvSamLogoff
MsvSamValidate
MsvGetLogonAttemptCount

msvcrt

wcscmp
wcstoul
_strnicmp
wcsstr
sprintf
_wcsnicmp
swprintf
srand
_vsnprintf
strchr
qsort
rand
wcsrchr
free
_initterm
wcslen
_adjust_fdiv
wcschr
wcsncpy
isprint
_ltoa
time
_ultoa
_itoa
wcsspn
towupper
_wcsupr
strcspn
iswctype
wcscspn
_except_handler3
wcscat
strncmp
malloc
_wcsicmp
memmove
wcscpy

netapi32

I_NetLogonSamLogonEx
NetGetDCName
I_NetServerPasswordGet
I_NetServerAuthenticate
I_NetServerAuthenticate2
I_NetServerAuthenticate3
NetApiBufferFree
I_NetNameCanonicalize
I_NetNameCompare
NetApiBufferAllocate
I_NetGetForestTrustInformation
I_NetLogonSamLogon
I_NetLogonSamLogonWithFlags
I_NetLogonSamLogoff
NetAlertRaiseEx
NetpIsRemote
I_NetLogonGetDomainInfo
NlBindingAddServerToCache
NlBindingSetAuthInfo
NlBindingRemoveServerFromCache
I_NetServerGetTrustInfo
I_NetServerTrustPasswordsGet
NetSessionEnum
I_NetPathCanonicalize
I_NetServerSetServiceBitsEx
NetServerComputerNameDel
NetServerTransportEnum
NetServerTransportAddEx
NetServerTransportDel
I_NetServerPasswordSet2
I_NetServerPasswordSet
NetShareAdd
NetShareGetInfo
NetShareDel
I_NetServerReqChallenge
I_NetLogonSendToSam

ntdll

RtlLengthSid
RtlEqualSid
RtlInitUnicodeString
RtlAllocateAndInitializeSid
RtlGetNtProductType
RtlFreeSid
RtlFreeUnicodeString
RtlCreateUnicodeString
RtlUpcaseUnicodeToOemN
RtlEqualDomainName
RtlEqualComputerName
RtlDeleteResource
RtlReleaseResource
RtlAcquireResourceExclusive
NtClose
RtlSubAuthoritySid
RtlSubAuthorityCountSid
NtQueryInformationToken
NtOpenThreadToken
RtlExtendedMagicDivide
NtOpenFile
NtCancelIoFile
NtDeviceIoControlFile
NtCreateFile
RtlUpcaseUnicodeStringToOemString
RtlOemToUnicodeN
NtSetEvent
NtOpenEvent
NtCreateEvent
RtlInitializeResource
RtlxUnicodeStringToOemSize
NlsMbOemCodePageTag
DbgPrint
RtlCopyUnicodeString
RtlTimeToTimeFields
RtlSystemTimeToLocalTime
RtlValidSid
RtlConvertSidToUnicodeString
RtlAcquireResourceShared
RtlEqualUnicodeString
RtlCompareUnicodeString
RtlIntegerToUnicodeString
RtlCopySid
RtlLeaveCriticalSection
RtlEnterCriticalSection
RtlImpersonateSelf
RtlDowncaseUnicodeString
RtlInitString
NtImpersonateAnonymousToken
NtSetInformationThread
RtlOemStringToUnicodeString
RtlxOemStringToUnicodeSize
RtlCompareMemoryUlong
RtlNtStatusToDosError
RtlInitializeSid
RtlLengthRequiredSid
RtlDeleteSecurityObject
RtlSetSaclSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAce
RtlCreateAcl
RtlNewSecurityObject
NtOpenProcessToken
RtlUniform
NtQuerySystemTime
RtlTimeToSecondsSince1980
RtlInitAnsiString
RtlSetEnvironmentVariable
RtlExpandEnvironmentStrings_U
RtlCreateEnvironment
RtlDestroyEnvironment
RtlDetermineDosPathNameType_U
RtlIsDosDeviceName_U
RtlTimeToSecondsSince1970

ntdsapi

DsUnBindW
DsCrackNamesW
DsFreeNameResultW
DsBindW

rpcrt4

RpcServerInqBindings
UuidToStringA
RpcServerUnregisterIf
NdrServerCall2
RpcRevertToSelf
RpcImpersonateClient
RpcBindingInqAuthClientW
RpcBindingVectorFree
RpcEpRegisterW
RpcServerUseProtseqExW
RpcServerRegisterIfEx
RpcServerUseProtseqEpW
RpcServerRegisterAuthInfoW
RpcStringFreeW
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcBindingFree
RpcBindingToStringBindingW
RpcBindingServerFromClient
RpcServerYield
RpcCancelThread
RpcBindingSetAuthInfoW
RpcMgmtSetCancelTimeout
RpcBindingSetAuthInfoExA
RpcBindingFromStringBindingA
RpcStringBindingComposeA
NdrClientCall2
RpcStringFreeA

samsrv

SamIEnumerateAccountRids
SamrQueryDisplayInformation
SamrEnumerateAliasesInDomain
SamIFree_SAMPR_ENUMERATION_BUFFER
SamISetPasswordInfoOnPdc
SamrSetInformationUser
SamIResetBadPwdCountOnPdc
SamINetLogonPing
SamIFree_SAMPR_GROUP_INFO_BUFFER
SamIFree_SAMPR_SR_SECURITY_DESCRIPTOR
SamrQueryInformationGroup
SamrQuerySecurityObject
SamIOpenAccount
SamIFree_SAMPR_GET_MEMBERS_BUFFER
SamrGetMembersInGroup
SamIFree_SAMPR_ALIAS_INFO_BUFFER
SamrQueryInformationAlias
SamIFree_SAMPR_PSID_ARRAY
SamrGetMembersInAlias
SamrQueryInformationUser
SamIFreeSidArray
SamIGetResourceGroupMembershipsTransitive
SamrLookupNamesInDomain
SamISameSite
SamIMixedDomain
SamrQueryInformationDomain
SamIFree_SAMPR_DOMAIN_INFO_BUFFER
SamIConnect
SamrOpenDomain
SamrCloseHandle
SamrOpenGroup
SamIFree_SAMPR_DISPLAY_INFO_BUFFER
SampUsingDsData
SamISetSerialNumberDomain
SamrGetAliasMembership
SamIFree_SAMPR_ULONG_ARRAY
SamIChangePasswordForeignUser
SamIGetUserLogonInformation
SamIFree_SAMPR_USER_INFO_BUFFER

user32

GetSystemMetrics

w32time

W32TimeGetNetlogonServiceBits

wldap32

ord119
ord13
ord141
ord26
ord117
ord40
ord41
ord79
ord46
ord145
ord14
ord73
ord152
ord18
ord55
ord189

ws2_32

WSAGetLastError
WSAAddressToStringA
WSAAddressToStringW
htons
ntohs
htonl
WSAStringToAddressW
WSACleanup
WSASocketW
WSAEventSelect
closesocket
WSAIoctl
ntohl
WSAStartup
inet_ntoa

Exports

Exports

DsrGetDcName
DsrGetDcNameEx2
I_DsGetDcCache
I_NetLogonAddressToSiteName
I_NetLogonAppendChangeLog
I_NetLogonCloseChangeLog
I_NetLogonFree
I_NetLogonGetAuthDataEx
I_NetLogonGetDirectDomain
I_NetLogonGetIpAddresses
I_NetLogonGetSerialNumber
I_NetLogonLdapLookup
I_NetLogonLdapLookupEx
I_NetLogonMixedDomain
I_NetLogonNewChangeLog
I_NetLogonReadChangeLog
I_NetLogonSendToSamOnPdc
I_NetLogonSetServiceBits
I_NetNotifyDelta
I_NetNotifyDsChange
I_NetNotifyMachineAccount
I_NetNotifyNetlogonDllHandle
I_NetNotifyNtdsDsaDeletion
I_NetNotifyRole
I_NetNotifyTrustedDomain
InitSecurityInterfaceW
NetrLogonSamLogoff
NetrLogonSamLogon
NlNetlogonMain

Sections

.text
Size: 372KB - Virtual size: 372KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rmnet
Size: 56KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

834a5664c9eedd80b1cdfa211751270f

Headers

File Characteristics

Imports

advapi32

cryptdll

dnsapi

kernel32

lsasrv

msv1_0

msvcrt

netapi32

ntdll

ntdsapi

rpcrt4

samsrv

user32

w32time

wldap32

ws2_32

Exports

Exports

Sections

.text Size: 372KB - Virtual size: 372KB

.data Size: 6KB - Virtual size: 7KB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 16KB - Virtual size: 15KB

.rmnet Size: 56KB - Virtual size: 60KB

.text
Size: 372KB - Virtual size: 372KB

.data
Size: 6KB - Virtual size: 7KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 16KB - Virtual size: 15KB

.rmnet
Size: 56KB - Virtual size: 60KB