a8bd234a3b1d3f967fd2b23a8f250364c3420de3a2ccb17546adb8eeedb21d10

Sharing

Copy URL Twitter E-mail

General

Target

a8bd234a3b1d3f967fd2b23a8f250364c3420de3a2ccb17546adb8eeedb21d10
Size

57KB
MD5

28fe4deef69b685cf2e39346fd8afb80
SHA1

dea1829af29d3c70a80c5077f19338e4d73fc249
SHA256

a8bd234a3b1d3f967fd2b23a8f250364c3420de3a2ccb17546adb8eeedb21d10
SHA512

d885d9ca997b7edf3e57746d42ceedcbbe09da54152ef314f282fb8c3c7da497318422d2a886c43183d5c9e971c3372b5af279fb2ecf523ac63eea49240d4189
SSDEEP

768:/xqFh+VThh2ZEtQHf6RSp3rVL/OpFK1+3pIbIy70K7CWOELGIwLLLsGY+1N:/QhkThAevRSp3rVKK1eHg0REXGY0

Score

N/A

Malware Config

Signatures

Files

a8bd234a3b1d3f967fd2b23a8f250364c3420de3a2ccb17546adb8eeedb21d10
.exe windows x86

ef16b0fbaa538503a74d4f490e240a53

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

crypt32

CryptDecryptAndVerifyMessageSignature
CryptCloseAsyncHandle
CryptMsgDuplicate
CryptSignAndEncodeCertificate
CryptDecryptMessage
CertVerifyValidityNesting
CryptMsgSignCTL
CryptMsgGetAndVerifySigner
CryptEnumOIDInfo
CertAddCTLContextToStore
CryptEnumKeyIdentifierProperties
CryptSignMessage
CertGetEnhancedKeyUsage
CryptSetKeyIdentifierProperty
CryptSIPRetrieveSubjectGuid
CertAddCertificateLinkToStore
CertStrToNameA
CryptVerifyMessageSignature
CryptMsgVerifyCountersignatureEncoded
CryptVerifyCertificateSignature
CertAddEncodedCertificateToSystemStoreW
CryptHashToBeSigned
CertCreateCertificateContext
CertEnumCRLsInStore
CryptDecodeObjectEx
CertCompareCertificateName
CertEnumCertificateContextProperties
CertSaveStore
CryptProtectData
CertCompareCertificate
CertCompareIntegerBlob
PFXIsPFXBlob
CryptUninstallDefaultContext
CertEnumCTLsInStore
CertFindCertificateInCRL
CertOpenStore
CertFindCTLInStore
CertFindAttribute
CryptMsgGetParam

ntdsapi

DsAddSidHistoryA
DsMakeSpnA
DsBindWithSpnA
DsFreePasswordCredentials
DsReplicaDelW

oleacc

GetOleaccVersionInfo

wtsapi32

WTSQueryUserConfigA
WTSEnumerateProcessesW
WTSFreeMemory
WTSEnumerateProcessesA
WTSDisconnectSession
WTSVirtualChannelPurgeOutput
WTSSetUserConfigA
WTSQuerySessionInformationA
WTSEnumerateServersW
WTSQueryUserConfigW
WTSVirtualChannelQuery
WTSLogoffSession
WTSTerminateProcess
WTSVirtualChannelWrite
WTSSetSessionInformationW
WTSVirtualChannelRead
WTSEnumerateSessionsA
WTSQuerySessionInformationW
WTSEnumerateSessionsW

kernel32

GetProcAddress
ExitProcess
InitializeCriticalSection
GetComputerNameExW

user32

DialogBoxParamA
SendMessageA
EndDialog

ws2_32

WSAAccept
WSAGetServiceClassNameByClassIdA
WSADuplicateSocketW
WSAEnumNetworkEvents
WSALookupServiceBeginA
WSCInstallNameSpace
WSAAsyncGetHostByName
WSCInstallProvider
inet_ntoa
WSCGetProviderPath
WSACloseEvent
WSAAsyncGetServByName
WSALookupServiceEnd
WSAInstallServiceClassW
WSAUnhookBlockingHook
WSAAsyncGetProtoByNumber
WSADuplicateSocketA
WSAEnumNameSpaceProvidersW
WSASocketW
send
WSAConnect
WSAAsyncGetHostByAddr
WSAEnumProtocolsA
WSALookupServiceNextA
gethostbyname
ntohs
WSACancelBlockingCall
bind
WSAJoinLeaf
WSAAsyncGetServByPort
recv
WSASetServiceA
gethostbyaddr
WSAEnumNameSpaceProvidersA
WSAStringToAddressW
inet_addr
WSAGetServiceClassInfoW
WSASend
WPUCompleteOverlappedRequest
WSANtohs
WSAEventSelect
WSACleanup
WSASetEvent
WSAAsyncGetProtoByName
WSASendDisconnect
WSAIoctl
listen
socket
getprotobyname
__WSAFDIsSet
WSACancelAsyncRequest
htonl
setsockopt
WSAIsBlocking
WSAProviderConfigChange
WSAHtonl
WSALookupServiceBeginW
htons
recvfrom
WEP
WSAAddressToStringA
WSCEnumProtocols

secur32

EnumerateSecurityPackagesW
FreeContextBuffer
GetUserNameExW
LsaRegisterPolicyChangeNotification
SaslEnumerateProfilesA
VerifySignature
CompleteAuthToken
QuerySecurityPackageInfoA
TranslateNameA
ApplyControlToken
LsaLookupAuthenticationPackage
AcquireCredentialsHandleW
InitSecurityInterfaceW
ImpersonateSecurityContext
GetUserNameExA
SaslEnumerateProfilesW
QuerySecurityPackageInfoW
SaslIdentifyPackageA
DeleteSecurityPackageA
SaslInitializeSecurityContextA
SaslAcceptSecurityContext
FreeCredentialsHandle
LsaDeregisterLogonProcess
GetComputerObjectNameW
LsaCallAuthenticationPackage
GetComputerObjectNameA
SaslIdentifyPackageW
QueryCredentialsAttributesW
InitializeSecurityContextW
LsaLogonUser

Sections

.text
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: 1024B - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ef16b0fbaa538503a74d4f490e240a53

Headers

File Characteristics

Imports

crypt32

ntdsapi

oleacc

wtsapi32

kernel32

user32

ws2_32

secur32

Sections

.text Size: 33KB - Virtual size: 32KB

.bss Size: 1024B - Virtual size: 7KB

.xdata Size: 4KB - Virtual size: 3KB

.rdata Size: 5KB - Virtual size: 5KB

.rsrc Size: 13KB - Virtual size: 16KB

.text
Size: 33KB - Virtual size: 32KB

.bss
Size: 1024B - Virtual size: 7KB

.xdata
Size: 4KB - Virtual size: 3KB

.rdata
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 13KB - Virtual size: 16KB