7b4ee675eab66b16a9a9e6a66f5db324f1e26f57c5706ce22aef473d9ab79e7a

Sharing

Copy URL Twitter E-mail

General

Target

7b4ee675eab66b16a9a9e6a66f5db324f1e26f57c5706ce22aef473d9ab79e7a
Size

393KB
MD5

915d5fdddff88ee492a71506c7a8c61a
SHA1

0df553867dc1fb40eedcdf6f1e9afa28e963b0f9
SHA256

7b4ee675eab66b16a9a9e6a66f5db324f1e26f57c5706ce22aef473d9ab79e7a
SHA512

89694fbf2485558571b4cad14c5bd7e2f68b1f7156c0a604e6fd8fe4ead84a820f985b69eb1f3ce2ffc5efcf94e15d6993ebb5e48574b6b928c3999f68f0c090
SSDEEP

6144:IJwJaSAc5P05L7R+LHBy4Jdx18UVsUDCltjowTEUq7DVv2L3l5E:H5gLELHK+Cv3S2Dv

Score

N/A

Malware Config

Signatures

Files

7b4ee675eab66b16a9a9e6a66f5db324f1e26f57c5706ce22aef473d9ab79e7a
.dll windows x86

b7a91a8b386cda2e12fa49f1b7d0a1b7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

gmtime
_ultoa
_adjust_fdiv
_initterm
wcsstr
_strnicmp
wcsncmp
malloc
free
wcstombs
mbstowcs
wcscpy
wcsrchr
iswctype
strcspn
towupper
wcscspn
_stricmp
_wcslwr
_wcsupr
time
srand
rand
wcschr
_wcsnicmp
wcstoul
wcsspn
sprintf
_vsnprintf
swprintf
qsort
strncpy
isdigit
wcsncat
_strupr
wcscmp
memmove
_wcsicmp
wcscat
wcsncpy
_except_handler3
wcslen
iswdigit

ntdll

RtlValidSecurityDescriptor
RtlMakeSelfRelativeSD
RtlDnsHostNameToComputerName
RtlLengthSecurityDescriptor
RtlSecondsSince1970ToTime
RtlGetDaclSecurityDescriptor
RtlCreateUnicodeString
NtOpenEvent
NtWaitForMultipleObjects
NtCreateEvent
NtDeviceIoControlFile
NtWaitForSingleObject
NtResetEvent
NtSetEvent
RtlIsDosDeviceName_U
RtlDetermineDosPathNameType_U
RtlDestroyEnvironment
RtlCreateEnvironment
RtlExpandEnvironmentStrings_U
RtlSetEnvironmentVariable
RtlUnicodeToOemN
RtlQueryTimeZoneInformation
RtlTimeToSecondsSince1980
RtlExtendedIntegerMultiply
RtlExtendedMagicDivide
RtlQueryInformationAcl
RtlGetAce
NtOpenThreadToken
NtImpersonateAnonymousToken
NtCreateFile
NtFsControlFile
NtQuerySystemTime
RtlTimeToSecondsSince1970
RtlUpcaseUnicodeToOemN
RtlUpcaseUnicodeString
RtlGetNtProductType
RtlRunDecodeUnicodeString
RtlRunEncodeUnicodeString
NtOpenFile
RtlFreeOemString
RtlConvertSidToUnicodeString
RtlFreeUnicodeString
RtlCompareMemory
RtlUpcaseUnicodeStringToOemString
RtlInitAnsiString
NtDuplicateToken
NtAdjustPrivilegesToken
NtSetInformationThread
RtlCompareMemoryUlong
RtlNewSecurityObject
RtlCreateAcl
RtlAddAce
RtlCreateSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlSetSaclSecurityDescriptor
RtlDeleteSecurityObject
RtlCopySid
RtlSubAuthoritySid
RtlInitializeSid
DbgPrint
RtlInitUnicodeStringEx
RtlxUnicodeStringToAnsiSize
RtlUnicodeStringToAnsiString
NlsMbCodePageTag
RtlxAnsiStringToUnicodeSize
RtlAnsiStringToUnicodeString
RtlInitString
RtlxOemStringToUnicodeSize
RtlOemStringToUnicodeString
NlsMbOemCodePageTag
RtlxUnicodeStringToOemSize
RtlUnicodeStringToOemString
RtlEqualSid
RtlEqualUnicodeString
RtlAllocateHeap
RtlFreeHeap
RtlCompareUnicodeString
RtlLengthSid
RtlAdjustPrivilege
NtAccessCheckAndAuditAlarm
RtlConvertUiListToApiList
RtlInitUnicodeString
NtOpenProcessToken
NtQueryInformationToken
RtlCopyLuid
NtClose
RtlUnicodeToMultiByteN
RtlNtStatusToDosError
RtlInitializeCriticalSection
RtlCopyUnicodeString
RtlUniform

advapi32

RegSetValueExW
SetFileSecurityW
GetFileSecurityW
IsValidSecurityDescriptor
RegOpenKeyExA
RegQueryValueExA
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
LookupAccountNameW
ConvertSecurityDescriptorToStringSecurityDescriptorW
RegSetKeySecurity
RegGetKeySecurity
AllocateAndInitializeSid
FreeSid
EnumServicesStatusW
EqualSid
LsaLookupNames2
LsaGetUserName
LsaLookupSids
CredUnmarshalCredentialW
CredFree
SystemFunction034
MD5Init
MD5Update
MD5Final
SystemFunction036
OpenSCManagerA
OpenServiceA
StartServiceA
SystemFunction007
SystemFunction001
RegQueryInfoKeyW
RegFlushKey
RegEnumValueW
ChangeServiceConfigW
StartServiceW
EnumDependentServicesW
ControlService
OpenSCManagerW
OpenServiceW
QueryServiceConfigW
QueryServiceStatus
CloseServiceHandle
RevertToSelf
SetThreadToken
LsaDelete
LsaCreateSecret
LsaQuerySecret
LsaSetSecret
LsaSetInformationPolicy
RegDeleteKeyW
RegCreateKeyExW
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
LookupAccountSidW
GetSidSubAuthorityCount
GetSidSubAuthority
RegOpenKeyW
LsaOpenSecret
RegConnectRegistryW
RegOpenKeyExW
LsaOpenPolicy
LsaQueryInformationPolicy
LsaFreeMemory
LsaClose
RegQueryValueExW
RegCloseKey
OpenThreadToken
AccessCheck
SystemFunction016
SystemFunction006
SystemFunction012

rpcrt4

RpcImpersonateClient
RpcStringFreeW
I_RpcExceptionFilter
RpcBindingSetAuthInfoW
RpcEpResolveBinding
RpcBindingFromStringBindingW
RpcRevertToSelf
RpcStringBindingComposeW
I_RpcMapWin32Status
NdrClientCall2
RpcBindingSetAuthInfoExW
RpcBindingFree
UuidCreate
RpcStringFreeA
UuidToStringA

kernel32

WideCharToMultiByte
GetComputerNameW
GetThreadLocale
LoadLibraryW
GetVersionExW
lstrlenW
Sleep
GetSystemWindowsDirectoryW
lstrcpyA
lstrlenA
lstrcatA
CreateMailslotA
GetTimeZoneInformation
LocalAlloc
LocalFree
GetComputerNameExW
FlushFileBuffers
EnterCriticalSection
GetLocalTime
LeaveCriticalSection
GetWindowsDirectoryW
GetFileAttributesW
CreateDirectoryW
SetFilePointer
GetFileSize
MoveFileExW
InitializeCriticalSection
GetCurrentThread
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
LoadLibraryA
InterlockedCompareExchange
FreeLibrary
GetProcAddress
DelayLoadFailureHook
CreateEventW
DisableThreadLibraryCalls
DeleteCriticalSection
CreateFileW
GetLastError
WriteFile
CloseHandle
WaitForSingleObjectEx
SetMailslotInfo
ReadFile
MultiByteToWideChar
lstrcmpiW
IsBadWritePtr
GetModuleFileNameA
InterlockedDecrement
InterlockedIncrement
SetThreadPriority
CreateThread
ExitThread
HeapAlloc
InterlockedExchange
LocalReAlloc
LocalHandle
LocalSize
SetComputerNameExW
ExpandEnvironmentStringsW
HeapFree
GetProcessHeap
GetCurrentProcess

Exports

Exports

CredpValidateTargetName
DsAddressToSiteNamesA
DsAddressToSiteNamesExA
DsAddressToSiteNamesExW
DsAddressToSiteNamesW
DsDeregisterDnsHostRecordsA
DsDeregisterDnsHostRecordsW
DsEnumerateDomainTrustsA
DsEnumerateDomainTrustsW
DsGetDcCloseW
DsGetDcNameA
DsGetDcNameW
DsGetDcNameWithAccountA
DsGetDcNameWithAccountW
DsGetDcNextA
DsGetDcNextW
DsGetDcOpenA
DsGetDcOpenW
DsGetDcSiteCoverageA
DsGetDcSiteCoverageW
DsGetForestTrustInformationW
DsGetSiteNameA
DsGetSiteNameW
DsMergeForestTrustInformationW
DsRoleAbortDownlevelServerUpgrade
DsRoleCancel
DsRoleDcAsDc
DsRoleDcAsReplica
DsRoleDemoteDc
DsRoleDnsNameToFlatName
DsRoleFreeMemory
DsRoleGetDatabaseFacts
DsRoleGetDcOperationProgress
DsRoleGetDcOperationResults
DsRoleGetPrimaryDomainInformation
DsRoleIfmHandleFree
DsRoleServerSaveStateForUpgrade
DsRoleUpgradeDownlevelServer
DsValidateSubnetNameA
DsValidateSubnetNameW
I_BrowserDebugCall
I_BrowserDebugTrace
I_BrowserQueryEmulatedDomains
I_BrowserQueryOtherDomains
I_BrowserQueryStatistics
I_BrowserResetNetlogonState
I_BrowserResetStatistics
I_BrowserServerEnum
I_BrowserSetNetlogonState
I_NetAccountDeltas
I_NetAccountSync
I_NetDatabaseDeltas
I_NetDatabaseRedo
I_NetDatabaseSync
I_NetDatabaseSync2
I_NetDfsCreateExitPoint
I_NetDfsCreateLocalPartition
I_NetDfsDeleteExitPoint
I_NetDfsDeleteLocalPartition
I_NetDfsFixLocalVolume
I_NetDfsGetFtServers
I_NetDfsGetVersion
I_NetDfsIsThisADomainName
I_NetDfsManagerReportSiteInfo
I_NetDfsModifyPrefix
I_NetDfsSetLocalVolumeState
I_NetDfsSetServerInfo
I_NetGetDCList
I_NetGetForestTrustInformation
I_NetListCanonicalize
I_NetListTraverse
I_NetLogonControl
I_NetLogonControl2
I_NetLogonGetDomainInfo
I_NetLogonSamLogoff
I_NetLogonSamLogon
I_NetLogonSamLogonEx
I_NetLogonSamLogonWithFlags
I_NetLogonSendToSam
I_NetLogonUasLogoff
I_NetLogonUasLogon
I_NetNameCanonicalize
I_NetNameCompare
I_NetNameValidate
I_NetPathCanonicalize
I_NetPathCompare
I_NetPathType
I_NetServerAuthenticate
I_NetServerAuthenticate2
I_NetServerAuthenticate3
I_NetServerGetTrustInfo
I_NetServerPasswordGet
I_NetServerPasswordSet
I_NetServerPasswordSet2
I_NetServerReqChallenge
I_NetServerSetServiceBits
I_NetServerSetServiceBitsEx
I_NetServerTrustPasswordsGet
I_NetlogonComputeClientDigest
I_NetlogonComputeServerDigest
I_NetlogonGetTrustRid
NetAddAlternateComputerName
NetAlertRaise
NetAlertRaiseEx
NetApiBufferAllocate
NetApiBufferFree
NetApiBufferReallocate
NetApiBufferSize
NetAuditClear
NetAuditRead
NetAuditWrite
NetBrowserStatisticsGet
NetConfigGet
NetConfigGetAll
NetConfigSet
NetConnectionEnum
NetDfsAdd
NetDfsAddFtRoot
NetDfsAddStdRoot
NetDfsAddStdRootForced
NetDfsEnum
NetDfsGetClientInfo
NetDfsGetDcAddress
NetDfsGetFtContainerSecurity
NetDfsGetInfo
NetDfsGetSecurity
NetDfsGetStdContainerSecurity
NetDfsManagerGetConfigInfo
NetDfsManagerInitialize
NetDfsManagerSendSiteInfo
NetDfsMove
NetDfsRemove
NetDfsRemoveFtRoot
NetDfsRemoveFtRootForced
NetDfsRemoveStdRoot
NetDfsRename
NetDfsSetClientInfo
NetDfsSetFtContainerSecurity
NetDfsSetInfo
NetDfsSetSecurity
NetDfsSetStdContainerSecurity
NetEnumerateComputerNames
NetEnumerateTrustedDomains
NetErrorLogClear
NetErrorLogRead
NetErrorLogWrite
NetFileClose
NetFileEnum
NetFileGetInfo
NetGetAnyDCName
NetGetDCName
NetGetDisplayInformationIndex
NetGetJoinInformation
NetGetJoinableOUs
NetGroupAdd
NetGroupAddUser
NetGroupDel
NetGroupDelUser
NetGroupEnum
NetGroupGetInfo
NetGroupGetUsers
NetGroupSetInfo
NetGroupSetUsers
NetJoinDomain
NetLocalGroupAdd
NetLocalGroupAddMember
NetLocalGroupAddMembers
NetLocalGroupDel
NetLocalGroupDelMember
NetLocalGroupDelMembers
NetLocalGroupEnum
NetLocalGroupGetInfo
NetLocalGroupGetMembers
NetLocalGroupSetInfo
NetLocalGroupSetMembers
NetLogonGetTimeServiceParentDomain
NetLogonSetServiceBits
NetMessageBufferSend
NetMessageNameAdd
NetMessageNameDel
NetMessageNameEnum
NetMessageNameGetInfo
NetQueryDisplayInformation
NetRegisterDomainNameChangeNotification
NetRemoteComputerSupports
NetRemoteTOD
NetRemoveAlternateComputerName
NetRenameMachineInDomain
NetReplExportDirAdd
NetReplExportDirDel
NetReplExportDirEnum
NetReplExportDirGetInfo
NetReplExportDirLock
NetReplExportDirSetInfo
NetReplExportDirUnlock
NetReplGetInfo
NetReplImportDirAdd
NetReplImportDirDel
NetReplImportDirEnum
NetReplImportDirGetInfo
NetReplImportDirLock
NetReplImportDirUnlock
NetReplSetInfo
NetScheduleJobAdd
NetScheduleJobDel
NetScheduleJobEnum
NetScheduleJobGetInfo
NetServerComputerNameAdd
NetServerComputerNameDel
NetServerDiskEnum
NetServerEnum
NetServerEnumEx
NetServerGetInfo
NetServerSetInfo
NetServerTransportAdd
NetServerTransportAddEx
NetServerTransportDel
NetServerTransportEnum
NetServiceControl
NetServiceEnum
NetServiceGetInfo
NetServiceInstall
NetSessionDel
NetSessionEnum
NetSessionGetInfo
NetSetPrimaryComputerName
NetShareAdd
NetShareCheck
NetShareDel
NetShareDelSticky
NetShareEnum
NetShareEnumSticky
NetShareGetInfo
NetShareSetInfo
NetStatisticsGet
NetUnjoinDomain
NetUnregisterDomainNameChangeNotification
NetUseAdd
NetUseDel
NetUseEnum
NetUseGetInfo
NetUserAdd
NetUserChangePassword
NetUserDel
NetUserEnum
NetUserGetGroups
NetUserGetInfo
NetUserGetLocalGroups
NetUserModalsGet
NetUserModalsSet
NetUserSetGroups
NetUserSetInfo
NetValidateName
NetValidatePasswordPolicy
NetValidatePasswordPolicyFree
NetWkstaGetInfo
NetWkstaSetInfo
NetWkstaTransportAdd
NetWkstaTransportDel
NetWkstaTransportEnum
NetWkstaUserEnum
NetWkstaUserGetInfo
NetWkstaUserSetInfo
NetapipBufferAllocate
Netbios
NetpAccessCheck
NetpAccessCheckAndAudit
NetpAddTlnFtinfoEntry
NetpAllocConfigName
NetpAllocFtinfoEntry
NetpAllocStrFromWStr
NetpAllocWStrFromStr
NetpAllocWStrFromWStr
NetpApiStatusToNtStatus
NetpAssertFailed
NetpCleanFtinfoContext
NetpCloseConfigData
NetpCopyFtinfoContext
NetpCopyStringToBuffer
NetpCreateSecurityObject
NetpDbgPrint
NetpDeleteSecurityObject
NetpGetComputerName
NetpGetConfigBool
NetpGetConfigDword
NetpGetConfigTStrArray
NetpGetConfigValue
NetpGetDomainName
NetpGetFileSecurity
NetpGetPrivilege
NetpHexDump
NetpInitFtinfoContext
NetpInitOemString
NetpIsRemote
NetpIsUncComputerNameValid
NetpLocalTimeZoneOffset
NetpLogonPutUnicodeString
NetpMergeFtinfo
NetpNetBiosAddName
NetpNetBiosCall
NetpNetBiosDelName
NetpNetBiosGetAdapterNumbers
NetpNetBiosHangup
NetpNetBiosReceive
NetpNetBiosReset
NetpNetBiosSend
NetpNetBiosStatusToApiStatus
NetpNtStatusToApiStatus
NetpOpenConfigData
NetpPackString
NetpParmsQueryUserProperty
NetpParmsQueryUserPropertyWithLength
NetpParmsSetUserProperty
NetpParmsSetUserPropertyWithLength
NetpParmsUserPropertyFree
NetpReleasePrivilege
NetpSetFileSecurity
NetpSmbCheck
NetpStoreIntialDcRecord
NetpStringToNetBiosName
NetpTStrArrayEntryCount
NetpUpgradePreNT5JoinInfo
NetpwNameCanonicalize
NetpwNameCompare
NetpwNameValidate
NetpwPathCanonicalize
NetpwPathCompare
NetpwPathType
NlBindingAddServerToCache
NlBindingRemoveServerFromCache
NlBindingSetAuthInfo
RxNetAccessAdd
RxNetAccessDel
RxNetAccessEnum
RxNetAccessGetInfo
RxNetAccessGetUserPerms
RxNetAccessSetInfo
RxNetServerEnum
RxNetUserPasswordSet
RxRemoteApi

Sections

.text
Size: 314KB - Virtual size: 314KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b7a91a8b386cda2e12fa49f1b7d0a1b7

Headers

File Characteristics

Imports

msvcrt

ntdll

advapi32

rpcrt4

kernel32

Exports

Exports

Sections

.text Size: 314KB - Virtual size: 314KB

.data Size: 66KB - Virtual size: 66KB

.rsrc Size: 1024B - Virtual size: 1016B

.reloc Size: 10KB - Virtual size: 10KB

.text
Size: 314KB - Virtual size: 314KB

.data
Size: 66KB - Virtual size: 66KB

.rsrc
Size: 1024B - Virtual size: 1016B

.reloc
Size: 10KB - Virtual size: 10KB