9e51b995344184c784e7b6840d8a3ae8b92c8c58d84f949692093dde6f879a29

Sharing

Copy URL Twitter E-mail

General

Target

9e51b995344184c784e7b6840d8a3ae8b92c8c58d84f949692093dde6f879a29
Size

259KB
MD5

dd74e9fafaf6610433eda9e0f965b584
SHA1

36dd4ab61067185885e96691999dc9243ea56137
SHA256

9e51b995344184c784e7b6840d8a3ae8b92c8c58d84f949692093dde6f879a29
SHA512

80da339a5311354731ef697e03f197bb95ad85ef81915dffb1ae8de8519fe1707db38d95f7bd7a88cc1bbe2a2a3bbde472e487b466920d494bbf91a5b115d1d9
SSDEEP

3072:twIuN3HtyNX+kxRjqKWcDrJaw1E/bUDk9tY8l8MgwhIWYaiGh5PrkWFCkIzeG7Kw:twIuNXYNXBjJWcDQeobGvl

Score

N/A

Malware Config

Signatures

Files

9e51b995344184c784e7b6840d8a3ae8b92c8c58d84f949692093dde6f879a29
.exe windows x64

75127e64e9965588b8ab65d98ae01a54

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

LsaQueryInformationPolicy
LsaOpenPolicy
LsaClose
CreateWellKnownSid
CreateProcessWithLogonW
CreateProcessAsUserW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumValueW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegSetValueExW
CloseServiceHandle
DeleteService
OpenSCManagerW
OpenServiceW
StartServiceW
QueryServiceStatusEx
ControlService
IsTextUnicode
ConvertSidToStringSidW
OpenProcessToken
GetTokenInformation
LookupAccountSidW
ConvertStringSidToSidW
CryptExportKey
CryptAcquireContextW
CryptGetKeyParam
CryptReleaseContext
CryptEnumProvidersW
CryptGetProvParam
CryptGenRandom
CryptImportKey
CryptDestroyKey
CryptGetUserKey
OpenEventLogW
GetNumberOfEventLogRecords
ClearEventLogW
CreateServiceW
SetServiceObjectSecurity
BuildSecurityDescriptorW
QueryServiceObjectSecurity
AllocateAndInitializeSid
FreeSid
CryptGetHashParam
CryptSetKeyParam
SystemFunction032
SystemFunction005
LsaQueryTrustedDomainInfoByName
SystemFunction007
SystemFunction006
SystemFunction025
CryptCreateHash
CryptDecrypt
CryptDestroyHash
LsaEnumerateTrustedDomainsEx
LsaFreeMemory
CryptHashData
OpenThreadToken
SetThreadToken
DuplicateTokenEx
CheckTokenMembership
CredFree
CredEnumerateW
A_SHAFinal
MD4Update
MD4Final
MD4Init
A_SHAUpdate
A_SHAInit

crypt32

CryptBinaryToStringW
CryptAcquireCertificatePrivateKey
CertGetNameStringW
CertAddEncodedCertificateToStore
CertOpenStore
CertFreeCertificateContext
CertAddCertificateContextToStore
CertCloseStore
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CertEnumSystemStore
CertSetCertificateContextProperty
PFXExportCertStoreEx

cryptdll

CDGenerateRandomBits
CDLocateCheckSum
MD5Final
MD5Update
MD5Init
CDLocateCSystem

ntdsapi

DsBindW
DsAddSidHistoryW
DsUnBindW

shlwapi

PathCombineW
PathCanonicalizeW
PathIsRelativeW

samlib

SamGetAliasMembership
SamFreeMemory
SamRidToSid
SamCloseHandle
SamQueryInformationUser
SamEnumerateDomainsInSamServer
SamEnumerateUsersInDomain
SamOpenUser
SamLookupNamesInDomain
SamLookupIdsInDomain
SamOpenDomain
SamConnect
SamGetGroupsForUser
SamLookupDomainInSamServer

secur32

LsaDeregisterLogonProcess
LsaConnectUntrusted
LsaFreeReturnBuffer
LsaLookupAuthenticationPackage
LsaCallAuthenticationPackage

shell32

CommandLineToArgvW

user32

IsCharAlphaNumericW

ntdll

_wcstoui64
wcstol
wcstoul
wcsstr
_wcsnicmp
_stricmp
_wcsicmp
wcschr
wcsrchr
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
RtlInitUnicodeString
RtlEqualUnicodeString
NtQueryObject
NtQuerySystemInformation
RtlGetCurrentPeb
NtQueryInformationProcess
RtlCreateUserThread
RtlStringFromGUID
RtlFreeUnicodeString
RtlGetNtVersionNumbers
RtlUpcaseUnicodeString
RtlAppendUnicodeStringToString
RtlAnsiStringToUnicodeString
RtlDowncaseUnicodeString
RtlGUIDFromString
NtResumeProcess
RtlAdjustPrivilege
NtSuspendProcess
NtTerminateProcess
RtlEqualString
__chkstk
memcmp

kernel32

GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
OutputDebugStringA
GetCurrentProcessId
GetCurrentThread
SetCurrentDirectoryW
GetConsoleScreenBufferInfo
FillConsoleOutputCharacterW
GetStdHandle
SetConsoleCursorPosition
GetModuleHandleW
GetProcAddress
LoadLibraryW
FreeLibrary
FindNextFileW
FindClose
GetFileAttributesW
GetSystemTimeAsFileTime
FindFirstFileW
SetConsoleTitleW
SetConsoleCtrlHandler
FileTimeToLocalFileTime
GetTimeFormatW
GetDateFormatW
CreateRemoteThread
WaitForSingleObject
SetLastError
CreateProcessW
SetConsoleOutputCP
GetConsoleOutputCP
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
WriteProcessMemory
VirtualAllocEx
VirtualProtectEx
VirtualAlloc
ReadProcessMemory
VirtualFreeEx
VirtualQueryEx
VirtualFree
VirtualQuery
SetFilePointer
DeviceIoControl
DuplicateHandle
GetLastError
OpenProcess
GetCurrentProcess
CloseHandle
GetCurrentDirectoryW
GetFileSizeEx
FlushFileBuffers
CreateFileW
ReadFile
WriteFile
LocalFree
LocalAlloc
FileTimeToSystemTime
Sleep
VirtualProtect

msvcrt

_read
_lseeki64
_write
_isatty
ungetc
__badioinfo
realloc
?terminate@@YAXXZ
__pioinfo
wcstombs
iswctype
ferror
malloc
wctomb
_itoa
_snprintf
_lock
_unlock
localeconv
isxdigit
isleadbyte
__mb_cur_max
_errno
mbtowc
fflush
_wfopen
_fileno
_iob
vwprintf
_setmode
fclose
free
_wcsdup
memcpy
memset
__C_specific_handler
__wgetmainargs
_XcptFilter
_exit
_cexit
exit
_initterm
_amsg_exit
__setusermatherr
_commode
_fmode
__set_app_type
calloc
isdigit
vfwprintf

Sections

.text
Size: 131KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 91KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

75127e64e9965588b8ab65d98ae01a54

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

crypt32

cryptdll

ntdsapi

shlwapi

samlib

secur32

shell32

user32

ntdll

kernel32

msvcrt

Sections

.text Size: 131KB - Virtual size: 131KB

.rdata Size: 91KB - Virtual size: 91KB

.data Size: 12KB - Virtual size: 14KB

.pdata Size: 4KB - Virtual size: 4KB

.rsrc Size: 16KB - Virtual size: 15KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 131KB - Virtual size: 131KB

.rdata
Size: 91KB - Virtual size: 91KB

.data
Size: 12KB - Virtual size: 14KB

.pdata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 16KB - Virtual size: 15KB

.reloc
Size: 2KB - Virtual size: 2KB