b1886e818247c47a3c23831a689b856835fe830c18f38b2fb1ed3da8a39e0572

Sharing

Copy URL Twitter E-mail

General

Target

b1886e818247c47a3c23831a689b856835fe830c18f38b2fb1ed3da8a39e0572
Size

140KB
MD5

5ef82e413eae7078156beebcbfc42b02
SHA1

3baccbff8c242523144771af3d7f644a5ba373bf
SHA256

b1886e818247c47a3c23831a689b856835fe830c18f38b2fb1ed3da8a39e0572
SHA512

e12a902579165a61c0b1b06b7c965412c10f109fd0b6af401e1741f9b7457a2441711fa590cccce3626ca26a4f8e5eda7efaad022565620da8fc284d80199428
SSDEEP

3072:R9sgnhmR6YTTscnTLWq15/8WOCNCm68vo/g49e1:/sD/T/nTLWqr8K28vo/g48

Score

N/A

Malware Config

Signatures

Files

b1886e818247c47a3c23831a689b856835fe830c18f38b2fb1ed3da8a39e0572
.dll regsvr32 windows x86

0c18f6e314f16d156c53491db245dabc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

wcsncat
wcscmp
_wcsupr
bsearch
_strnicmp
strtoul
wcsncpy
_ultow
wcsrchr
_wcsicmp
wcschr
_initterm
_adjust_fdiv
??1type_info@@UAE@XZ
__dllonexit
_onexit
sprintf
_wtoi64
_mbschr
_purecall
wcslen
__CxxFrameHandler
?terminate@@YAXXZ
wcscat
wcscpy
swprintf
??0exception@@QAE@ABV0@@Z
free
_CxxThrowException
malloc
_callnewh
wcstoul
_except_handler3

msvcp60

??1bad_alloc@std@@UAE@XZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
?nothrow@std@@3Unothrow_t@1@B
??0bad_alloc@std@@QAE@PBD@Z
??0bad_alloc@std@@QAE@ABV01@@Z

atl

ord21
ord18
ord22
ord15
ord32
ord16

ntdll

RtlInitUnicodeString
RtlNtStatusToDosError
RtlEqualSid
RtlSubAuthorityCountSid
RtlLengthRequiredSid
RtlAllocateHeap
RtlCopySid
RtlInitializeSid
RtlSubAuthoritySid
RtlGetNtProductType
RtlAdjustPrivilege
RtlInitString
NtAllocateLocallyUniqueId
RtlFreeHeap
RtlLengthSid
RtlCopySidAndAttributesArray
RtlAnsiStringToUnicodeString

iaspolcy

IASAttributeAddRef
IASAttributeAnsiAlloc
IASAttributeAlloc
IASAttributeRelease

iasrad

?radiusToIAS@VSAFilter@@QBEJPAUIAttributesRaw@@@Z
?radiusFromIAS@VSAFilter@@QBEJPAUIAttributesRaw@@@Z

iassvcs

IASGetLocalDictionary
IASAllocateUniqueID
IASAdler32
IASGetHostByName
IASGetDictionary
IASVariantChangeType
IASRegisterComponent

advapi32

DeregisterEventSource
RegisterEventSourceW
RegOpenKeyW
RegNotifyChangeKeyValue
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteKeyW
GetTokenInformation
LsaOpenPolicy
LsaQueryInformationPolicy
LsaClose
LsaFreeMemory
SystemFunction017
SystemFunction019
SystemFunction008
SystemFunction009
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey

kernel32

CreateEventW
GetTimeZoneInformation
FreeLibrary
GetProcAddress
GetComputerNameW
ExpandEnvironmentStringsW
SwitchToThread
TryEnterCriticalSection
FileTimeToSystemTime
InterlockedCompareExchange
RegisterWaitForSingleObject
InterlockedExchange
GetSystemTimeAsFileTime
UnregisterWait
WaitForSingleObject
CreateThread
SetEvent
LocalAlloc
LocalFree
SetLastError
FormatMessageA
Sleep
GetModuleFileNameW
VirtualQuery
SystemTimeToFileTime
LoadLibraryW
DisableThreadLibraryCalls
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
MultiByteToWideChar
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
GetLastError
CloseHandle

netapi32

NetRegisterDomainNameChangeNotification
NetApiBufferFree
DsGetDcNameW
NetpParmsQueryUserProperty
NetpParmsSetUserProperty
NetUnregisterDomainNameChangeNotification

ntdsapi

DsCrackNamesW
DsUnBindW
DsBindW
DsBindWithCredA
DsFreeNameResultW

ole32

CoTaskMemAlloc
CoTaskMemFree

oleaut32

SafeArrayRedim
SafeArrayPtrOfIndex
SafeArrayCreate
VariantTimeToSystemTime
SetErrorInfo
LoadRegTypeLi
VariantClear
SysStringByteLen
SysAllocStringByteLen
SysAllocStringLen
SysFreeString
VariantInit
SysStringLen
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound

rtutils

TraceRegisterExW
TraceVprintfExA
TracePutsExA
TraceDeregisterW

user32

wsprintfA

wldap32

ord133
ord13
ord203
ord167
ord145
ord16
ord14
ord88
ord127
ord147
ord41
ord77
ord79
ord142
ord224
ord140
ord26
ord312
ord36
ord18
ord73

secur32

LsaLogonUser
LsaDeregisterLogonProcess
LsaCallAuthenticationPackage
LsaRegisterLogonProcess
LsaFreeReturnBuffer
LsaLookupAuthenticationPackage

samlib

SamLookupNamesInDomain
SamOpenUser
SamConnect
SamOpenDomain
SamiChangePasswordUser2
SamQueryInformationUser
SamGetGroupsForUser
SamGetAliasMembership
SamFreeMemory
SamiChangePasswordUser
SamCloseHandle
SamLookupDomainInSamServer

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IASParmsFreeUserParms
IASParmsQueryRasUser0
IASParmsQueryUserProperty
IASParmsSetRasUser0
IASParmsSetUserProperty

Sections

.text
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 57KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0c18f6e314f16d156c53491db245dabc

Headers

File Characteristics

Imports

msvcrt

msvcp60

atl

ntdll

iaspolcy

iasrad

iassvcs

advapi32

kernel32

netapi32

ntdsapi

ole32

oleaut32

rtutils

user32

wldap32

secur32

samlib

Exports

Exports

Sections

.text Size: 75KB - Virtual size: 74KB

.data Size: 57KB - Virtual size: 59KB

.rsrc Size: 1024B - Virtual size: 992B

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 75KB - Virtual size: 74KB

.data
Size: 57KB - Virtual size: 59KB

.rsrc
Size: 1024B - Virtual size: 992B

.reloc
Size: 6KB - Virtual size: 5KB