87a7d625d79447194b99f4c20b0119bc9bbb4320044a51559b6efb4988370ace

Sharing

Copy URL Twitter E-mail

General

Target

87a7d625d79447194b99f4c20b0119bc9bbb4320044a51559b6efb4988370ace
Size

866KB
MD5

69d635479455fb0b5e608558a4a27185
SHA1

32a8319f73a63a5cfc0cf83cf24739f7898cda84
SHA256

87a7d625d79447194b99f4c20b0119bc9bbb4320044a51559b6efb4988370ace
SHA512

b04eb1835133b428f484ea63cf61633fd8ff1735021100e94b2097825abd18115dda25caacb9330099eb23e8ea188d5531cd811842d2ea56ea5d9b7f8db12c10
SSDEEP

24576:jLnAbhBANy2amUP496XvD40uaynvQ3eGWaBW3f44:nna3T2LUPG6fDHudQ3lWagB

Score

N/A

Malware Config

Signatures

Files

87a7d625d79447194b99f4c20b0119bc9bbb4320044a51559b6efb4988370ace
.exe windows x86

9bb1a452d030c6b38ff7db792b8c76b3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

UnlockFile
RegisterWaitForSingleObject
GetStartupInfoA
InitializeSListHead
LZCloseFile
GetExpandedNameA
GetCurrentThread
SetFileApisToOEM
GetComputerNameExW
LoadLibraryA
GlobalDeleteAtom
SetLastError
GetSystemDefaultLCID
ClearCommBreak
MapViewOfFile
SetFilePointerEx
VirtualQuery
GetCurrentActCtx
QueryPerformanceCounter
VirtualAlloc
DefineDosDeviceW
GetProcessShutdownParameters
ReadConsoleOutputAttribute
GetCurrencyFormatA
GetSystemDefaultUILanguage

wldap32

ldap_search_sW
ldap_compare_sW
ldap_delete
ldap_modify_ext_s
ldap_search_stA
ldap_compareW
ldap_compare_ext_sA
ldap_get_next_page_s
ldap_modrdn2_sA
ber_first_element
ldap_control_free
ldap_stop_tls_s
ldap_start_tls_sA
ldap_compare_ext_sW
ldap_modrdnW
ldap_modrdn2W
ldap_bindA
cldap_open
ldap_modrdn_sA
ldap_get_values
ldap_initW
ldap_simple_bindA

msvcrt

srand
_mbsspn
_sys_errlist
_mbsnccnt
__lc_handle
strxfrm
__p__wpgmptr
isgraph
_ismbcpunct
abort
_strnset
_fpreset
swprintf
?set_new_handler@@YAP6AXXZP6AXXZ@Z
_wtempnam
_cabs
_wpopen
_snprintf
_unlink
__setusermatherr

user32

MessageBoxA
EndDialog

ntdll

ZwQueryVolumeInformationFile
RtlSystemTimeToLocalTime
iswxdigit
NtCompareTokens
RtlRemoteCall
RtlSetSecurityDescriptorRMControl
NtSetLowEventPair
NtSetHighWaitLowEventPair
ZwQuerySection
RtlUnlockBootStatusData
RtlInitializeSListHead
CsrCaptureMessageMultiUnicodeStringsInPlace
RtlDeleteAce
RtlFreeOemString
RtlDelete
NtTerminateProcess
RtlExtendedIntegerMultiply
RtlAreAllAccessesGranted
NtInitializeRegistry
RtlLengthRequiredSid
RtlMultiAppendUnicodeStringBuffer
RtlLargeIntegerAdd
_ltoa
ZwOpenThreadTokenEx
DbgUiContinue

rasapi32

RasDeleteSubEntryA
RasGetCountryInfoA
RasSetSharedAutoDial
RasSetCredentialsA
RasHangUpA
RasScriptReceive
RasSetAutodialAddressW
RasValidateEntryNameA
RasGetSubEntryPropertiesA
RasGetCredentialsW
RasRenameEntryW
RasGetCustomAuthDataW
RasGetProjectionInfoW
RasSetEntryPropertiesA
RasDialA
RasGetAutodialEnableA
RasGetAutodialEnableW
RasSetEntryPropertiesW
RasRenameEntryA
RasFreeEapUserIdentityA
RasDeleteSubEntryW
RasGetLinkStatistics

shell32

SHGetMalloc

Sections

.text
Size: 214KB - Virtual size: 213KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 292KB - Virtual size: 292KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 355KB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9bb1a452d030c6b38ff7db792b8c76b3

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

wldap32

msvcrt

user32

ntdll

rasapi32

shell32

Sections

.text Size: 214KB - Virtual size: 213KB

.rdata Size: 292KB - Virtual size: 292KB

.data Size: 355KB - Virtual size: 1.8MB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 214KB - Virtual size: 213KB

.rdata
Size: 292KB - Virtual size: 292KB

.data
Size: 355KB - Virtual size: 1.8MB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB