9789f2357a4d9b66470ee38ef28e2f8cbe8b69d988e518ae11a0c29e7a3fb000

Sharing

Copy URL Twitter E-mail

General

Target

9789f2357a4d9b66470ee38ef28e2f8cbe8b69d988e518ae11a0c29e7a3fb000
Size

149KB
MD5

0d34275fc6d296ca801a9e1b47ceaeb0
SHA1

c3781de93583dc9376da7a2773d1e276d3a0e301
SHA256

9789f2357a4d9b66470ee38ef28e2f8cbe8b69d988e518ae11a0c29e7a3fb000
SHA512

a376742dd6647fe652f451f385ad9473c15ea55488c475947b726d0cd2fb5da873f7908ee941d01115a2e1da6f8b4782e539a3b1f717a1d9b3ef210ab3b1d9a1
SSDEEP

3072:cyn5QtAuRqWMr8QBgOp5yPJmOthMopsWANCPj/h9/OHrSu:hQG8QmIys7bWANCr3OHGu

Score

N/A

Malware Config

Signatures

Files

9789f2357a4d9b66470ee38ef28e2f8cbe8b69d988e518ae11a0c29e7a3fb000
.exe windows x86

0c88689489bc2384f9a3b23dde07d2b2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

wcsncat
wcsstr
swprintf
_wcsrev
_ultow
rand
srand
wcsrchr
calloc
iswctype
wcscspn
memmove
_c_exit
_exit
_XcptFilter
_cexit
__initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_wcsicmp
malloc
realloc
free
wcschr
exit
sprintf
setlocale
_wcsnicmp
_iob
_setmode
qsort
wcsspn
wcsncpy
wcsncmp
wcscpy
_wcslwr
wcscat
wcslen
_wcsupr
wcscmp
_wfopen
wcstok
_wcsdup
ftell
fread
putchar
wcstod

advapi32

GetSidLengthRequired
OpenServiceW
QueryServiceStatus
EnumDependentServicesW
CloseServiceHandle
GetServiceDisplayNameW
OpenSCManagerW
GetServiceKeyNameW
RegConnectRegistryW
RegSetValueExW
RegDeleteValueW
LsaLookupNames
LsaLookupNames2
LsaOpenPolicy
LsaQueryInformationPolicy
GetLengthSid
LsaLookupSids
EqualSid
LsaFreeMemory
GetSidSubAuthorityCount
CopySid
GetSidSubAuthority
LsaClose
RegOpenKeyExW
RegQueryValueExW
RegCloseKey

kernel32

GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
LoadLibraryW
GetProcAddress
LocalFree
GetTickCount
SetLocalTime
SetSystemTime
GetProfileStringW
GetThreadLocale
GetSystemTimeAsFileTime
GetTimeFormatW
GetDriveTypeW
GetComputerNameW
WideCharToMultiByte
GetSystemTime
GetConsoleOutputCP
GetCPInfo
GetSystemDefaultLangID
SetThreadLocale
GetStdHandle
GetLastError
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleHandleA
GetComputerNameA
GetFileType
GlobalAlloc
GlobalFree
LocalReAlloc
lstrlenW
GetTimeZoneInformation
WriteConsoleW
LocalAlloc
WriteFile
FreeLibrary
SetLastError
GetModuleFileNameW
FormatMessageW
PeekConsoleInputW
GetConsoleMode
SetConsoleMode
ReadConsoleW
GetDateFormatW
GetComputerNameExW
Sleep
CompareStringW
GetUserDefaultLCID
GetCommandLineW

netapi32

NetShareEnum
NetShareSetInfo
I_NetPathType
NetShareCheck
NetShareDelSticky
NetServiceInstall
NetStatisticsGet
NetApiBufferReallocate
NetApiBufferAllocate
DsGetDcNameW
NetRemoteTOD
NetUserGetInfo
I_NetListTraverse
I_NetNameCompare
I_NetListCanonicalize
NetUserEnum
NetUserGetGroups
NetUserSetInfo
NetUseDel
NetUseEnum
NetapipBufferAllocate
NetWkstaUserGetInfo
NetWkstaGetInfo
NetServerEnum
NetServerGetInfo
NetServerSetInfo
I_NetNameValidate
NetShareGetInfo
NetApiBufferFree
NetUserModalsGet
NetUserModalsSet
NetServiceEnum
DsRoleFreeMemory
DsRoleGetPrimaryDomainInformation
NetServiceControl
NetSessionEnum
NetUserAdd
NetUserDel
NetFileClose
NetFileGetInfo
NetFileEnum
NetGroupAdd
NetGroupSetInfo
NetGroupDel
NetGroupAddUser
NetGroupDelUser
NetGroupEnum
NetGroupGetUsers
I_NetNameCanonicalize
NetGroupGetInfo
NetMessageNameEnum
NetMessageNameAdd
NetMessageNameDel
NetMessageBufferSend
NetWkstaTransportEnum
NetServerTransportEnum
NetSessionDel
NetSessionGetInfo
NetConnectionEnum
NetShareDel
NetShareAdd

samlib

SamDeleteAlias
SamRemoveMemberFromAlias
SamAddMemberToAlias
SamCreateAliasInDomain
SamGetAliasMembership
SamSetInformationAlias
SamGetMembersInAlias
SamEnumerateAliasesInDomain
SamConnect
SamOpenDomain
SamLookupNamesInDomain
SamCloseHandle
SamOpenAlias
SamFreeMemory
SamQueryInformationAlias
SamLookupIdsInDomain

ntdsapi

DsBindW
DsCrackNamesW
DsFreeNameResultW
DsUnBindW

ntdll

RtlUnicodeToOemN
RtlInitAnsiString
RtlxOemStringToUnicodeSize
RtlInitString
strrchr
strchr
_strnicmp
_stricmp
isdigit
RtlUnwind
NlsMbOemCodePageTag
RtlxUnicodeStringToOemSize
strncpy
RtlOemStringToUnicodeString
RtlInitUnicodeString
_ultoa
RtlCompareMemory
RtlQueryTimeZoneInformation
NtDuplicateToken
NtAdjustPrivilegesToken
NtSetInformationThread
RtlTimeFieldsToTime
RtlNtStatusToDosError
NtOpenProcessToken
NtClose
RtlSubAuthorityCountSid
RtlCopySid
RtlSubAuthoritySid
RtlLengthRequiredSid
RtlInitializeSid
wcspbrk
RtlAllocateHeap
_snwprintf
_vsnwprintf
_ftol
NtQuerySystemTime
RtlTimeToSecondsSince1970
RtlLengthSid
RtlGetNtProductType
NtFsControlFile
NtCreateFile
NtImpersonateAnonymousToken
NtOpenThreadToken

netrap

RapGetFieldSize
RapParmNumDescriptor
RapConvertSingleEntry
RapAsciiToDecimal
RapArrayLength
RapAuxDataCount
RapTotalSize
RapStructureSize
RapAuxDataCountOffset
RapConvertSingleEntryEx
RapStructureAlignment

Sections

.text
Size: 104KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 15KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

nfvycip
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

0c88689489bc2384f9a3b23dde07d2b2

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

advapi32

kernel32

netapi32

samlib

ntdsapi

ntdll

netrap

Sections

.text Size: 104KB - Virtual size: 104KB

.data Size: 15KB - Virtual size: 53KB

.rsrc Size: 28KB - Virtual size: 29KB

nfvycip Size: - Virtual size: 4KB

.text
Size: 104KB - Virtual size: 104KB

.data
Size: 15KB - Virtual size: 53KB

.rsrc
Size: 28KB - Virtual size: 29KB

nfvycip
Size: - Virtual size: 4KB