f29e4540d49dfce0d6610be559908a63bd8c404febf7255394462caddb836976

General

Target

f29e4540d49dfce0d6610be559908a63bd8c404febf7255394462caddb836976
Size

39KB
MD5

0d2b71b0af1785f6e8e68ba42d3b4a20
SHA1

2c5ad37adc909d782e072d735e43723b3a131f2c
SHA256

f29e4540d49dfce0d6610be559908a63bd8c404febf7255394462caddb836976
SHA512

1582255d0d786212fd6bf5f7692a5cdaf63893a888494ac30c07b75fe3d33b8eb363107d7ccc56734e3b4aaeccf4cce00e8b9da5f4c912f3bd3ae55d27032011
SSDEEP

768:R3tz4zRfMpy0BF4zkpTOb6plcvOWVw8Hh2Q4XOUsYyDU7FfCblT:Rdz4zRk5T4zkpTO2plnWVxYazYyQ7FfU

Score

N/A

Malware Config

Signatures

Files

f29e4540d49dfce0d6610be559908a63bd8c404febf7255394462caddb836976
.exe windows x86

13a5ec758c23c4ebec520a54a47e014a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

FreeSid
CheckTokenMembership
AllocateAndInitializeSid
OpenThreadToken
ImpersonateSelf
RevertToSelf

kernel32

CloseHandle
GetCurrentThread
ExitThread
SetUnhandledExceptionFilter
SetErrorMode
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
RtlUnwind
InterlockedExchange
VirtualQuery

ntdll

NtSetInformationProcess
RtlInitUnicodeString
NtCreateEvent
NtOpenEvent
NtSetEvent
NtClose
NtRaiseHardError
RtlAdjustPrivilege
NtShutdownSystem
RtlUnhandledExceptionFilter

lsasrv

LsaISetupWasRun
LsapDsDebugInitialize
LsapAuOpenSam
LsapCheckBootMode
ServiceInit
LsapInitLsa
LsapDsInitializePromoteInterface
LsapDsInitializeDsStateInfo

samsrv

SamIInitialize
SampUsingDsData

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ctdptzz
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

13a5ec758c23c4ebec520a54a47e014a

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

ntdll

lsasrv

samsrv

Sections

.text Size: 4KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 108B

.rsrc Size: 33KB - Virtual size: 35KB

ctdptzz Size: - Virtual size: 4KB

.text
Size: 4KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 108B

.rsrc
Size: 33KB - Virtual size: 35KB

ctdptzz
Size: - Virtual size: 4KB