50cb469ee4a2542f3e00e5173fe2e157daf3092ea81ddd16dcf6b38806ea9d35

Sharing

Copy URL Twitter E-mail

General

Target

50cb469ee4a2542f3e00e5173fe2e157daf3092ea81ddd16dcf6b38806ea9d35
Size

727KB
MD5

8514e517280ea493a4996aadd3727650
SHA1

3e992cdecf6339a6769b405111ae164056e0089a
SHA256

50cb469ee4a2542f3e00e5173fe2e157daf3092ea81ddd16dcf6b38806ea9d35
SHA512

576c74767b8d3b35da2e2015f44a56a6ed0b39acd468c4bbfb5d60fce05de2b78441856200ecebdd9b572ed99d315096b3f375bbc4284987c92631c38fb4b8e7
SSDEEP

12288:vf5ECjnxC3dmfK1ZoA+N48ZQSvK31z105pjszKrFWF6ACpi6qtiUFETY/9fbHtuN:3GGnxAmS1OHmsYF6BaaKBVNiaWnJCtGa

Score

N/A

Malware Config

Signatures

Files

50cb469ee4a2542f3e00e5173fe2e157daf3092ea81ddd16dcf6b38806ea9d35
.exe windows x64

72aa515b1963995c201e36de48594f61

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegQueryValueExW
RegOpenKeyW
RegCloseKey
LsaLookupSids
GetSidSubAuthority
LsaQueryInformationPolicy
LsaLookupNames
LsaOpenPolicy
GetSidSubAuthorityCount
CopySid
EqualSid
LsaLookupNames2
LsaClose
GetSidLengthRequired
GetLengthSid
LsaFreeMemory
InitializeSecurityDescriptor
LookupAccountNameW
SetSecurityDescriptorDacl
GetAce
LookupAccountSidW
InitializeAcl
AddAccessAllowedAce
GetSecurityDescriptorDacl
CreateWellKnownSid
CloseServiceHandle
OpenSCManagerW
EnumDependentServicesW
GetServiceKeyNameW
OpenServiceW
QueryServiceStatus
GetServiceDisplayNameW

kernel32

GetComputerNameExW
Sleep
GetUserDefaultLCID
CompareStringW
GetCommandLineW
GetCPInfo
SetThreadUILanguage
GetConsoleOutputCP
GetStdHandle
GetLastError
HeapSetInformation
WideCharToMultiByte
GetComputerNameW
GetDriveTypeW
LocalAlloc
LocalFree
GetDateFormatW
SetLocalTime
GetProfileStringW
GetTimeFormatW
SetSystemTime
GetTickCount
LoadLibraryW
GetProcAddress
GlobalAlloc
lstrlenW
GetTimeZoneInformation
FreeLibrary
SetLastError
GetModuleFileNameW
WriteConsoleW
FormatMessageW
WriteFile
GetFileType
PeekConsoleInputW
SetConsoleMode
GetConsoleMode
ReadConsoleW
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetModuleHandleW
GlobalFree

msvcrt

wcstok
_wcsdup
memcpy
wcstod
_vsnwprintf_s
putchar
_snwprintf_s
_local_unwind
wcspbrk
memset
?terminate@@YAXXZ
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
_initterm
_cexit
_exit
_XcptFilter
__C_specific_handler
wcscspn
iswctype
memmove
srand
rand
wcsrchr
calloc
_wcsrev
realloc
malloc
free
_ultow
swprintf_s
wcsncat_s
wcsstr
wcschr
exit
setlocale
_setmode
_iob
_fileno
_wcsnicmp
sprintf_s
wcsspn
qsort
wcscpy_s
wcsncmp
wcscat_s
_wcslwr
wcsncpy_s
_wcsupr
_wcsicmp
__getmainargs

dsrole

DsRoleFreeMemory
DsRoleGetPrimaryDomainInformation

netutils

NetApiBufferFree
NetApiBufferAllocate
NetpwListTraverse
NetpwNameCompare
NetpwListCanonicalize
NetApiBufferReallocate
NetpwPathType
NetpwNameCanonicalize
NetpwNameValidate
NetapipBufferAllocate

logoncli

DsGetDcNameW

browcli

NetServerEnum

samcli

NetUserEnum
NetUserGetGroups
NetUserGetInfo
NetUserSetInfo
NetGroupGetInfo
NetGroupAddUser
NetGroupEnum
NetGroupGetUsers
NetGroupSetInfo
NetGroupDel
NetGroupDelUser
NetGroupAdd
NetUserDel
NetUserAdd
NetUserModalsGet
NetUserModalsSet

srvcli

NetSessionEnum
NetFileGetInfo
NetFileClose
NetFileEnum
NetServerTransportEnum
NetConnectionEnum
NetSessionDel
NetSessionGetInfo
NetShareGetInfo
NetShareEnum
NetShareSetInfo
NetShareAdd
NetShareCheck
NetShareDelSticky
NetRemoteTOD
NetServerGetInfo
NetServerSetInfo
NetShareDel

wkscli

NetUseEnum
NetUseDel
NetWkstaUserGetInfo
NetWkstaGetInfo
NetWkstaTransportEnum

netapi32

NetStatisticsGet
NetServiceInstall
NetServiceControl
NetServiceEnum

samlib

SamConnect
SamOpenAlias
SamAddMemberToAlias
SamRemoveMemberFromAlias
SamQueryInformationAlias
SamCloseHandle
SamFreeMemory
SamDeleteAlias
SamSetInformationAlias
SamGetMembersInAlias
SamEnumerateAliasesInDomain
SamGetAliasMembership
SamCreateAliasInDomain
SamLookupNamesInDomain
SamLookupIdsInDomain
SamOpenDomain

ntdsapi

DsFreeNameResultW
DsUnBindW
DsBindW
DsCrackNamesW

ntdll

RtlTimeToSecondsSince1970
NtQuerySystemTime
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlAllocateHeap
RtlInitializeSid
RtlLengthRequiredSid
RtlSubAuthoritySid
RtlCopySid
RtlSubAuthorityCountSid
RtlLengthSid
NtClose
NtOpenProcessToken
RtlNtStatusToDosError
NtSetInformationThread
NtAdjustPrivilegesToken
NtDuplicateToken
RtlTimeFieldsToTime
RtlQueryTimeZoneInformation
RtlCompareMemory
RtlxOemStringToUnicodeSize
NlsMbOemCodePageTag
RtlOemStringToUnicodeString
RtlInitAnsiString
RtlGetNtProductType
RtlInitUnicodeString
RtlInitString

Sections

.text
Size: 118KB - Virtual size: 118KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 580KB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

72aa515b1963995c201e36de48594f61

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

dsrole

netutils

logoncli

browcli

samcli

srvcli

wkscli

netapi32

samlib

ntdsapi

ntdll

Sections

.text Size: 118KB - Virtual size: 118KB

.data Size: 22KB - Virtual size: 67KB

.pdata Size: 3KB - Virtual size: 3KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 580KB - Virtual size: 1.9MB

.text
Size: 118KB - Virtual size: 118KB

.data
Size: 22KB - Virtual size: 67KB

.pdata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 580KB - Virtual size: 1.9MB