2fe729cd2f8e0c169274d8c4b85e8dde31780550e4528616c3b0066fff58f022

Sharing

Copy URL Twitter E-mail

General

Target

2fe729cd2f8e0c169274d8c4b85e8dde31780550e4528616c3b0066fff58f022
Size

772KB
MD5

017828de7e65a8a0450670681c430c60
SHA1

e8d4f97d90350e78bea16be32cfce1218b0b765f
SHA256

2fe729cd2f8e0c169274d8c4b85e8dde31780550e4528616c3b0066fff58f022
SHA512

209771b4729523b180d32c7bc6a22117c5cbb84a6b960fc98b30585b7445ecaa5334fcc9d4f8cb85c3241b384d40b6f6cb98e560701fab795321d042680e2736
SSDEEP

12288:P4K3qj61xkZzwNp8nM41YOk8L87dN8AQIkymVevzUkG9pR45K41VovihXvO3QD:5t1xcsNp8n/CsLSN83IkHekQKeoqpD

Score

N/A

Malware Config

Signatures

Files

2fe729cd2f8e0c169274d8c4b85e8dde31780550e4528616c3b0066fff58f022
.exe windows x86

354073408d35e1d68bda539a0606a4f5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

ntdsapi

DsUnBindW
DsFreePasswordCredentials
DsFreeDomainControllerInfoW
DsBindWithCredW
DsCrackNamesW
DsCrackSpnW
DsFreeNameResultW
DsQuoteRdnValueW
DsMakePasswordCredentialsW
DsFreeSchemaGuidMapW
DsBindW
DsMakeSpnW
DsGetDomainControllerInfoW
DsMapSchemaGuidsW

msvcrt

_unlink
asctime
_itow
strtol
_control87
_strdate
??0exception@@QAE@XZ
_CIpow
?set_terminate@@YAP6AXXZP6AXXZ@Z
_getdrives
_memicmp
iswdigit
??1type_info@@UAE@XZ
sqrt
fputs
iscntrl
_strlwr
_mbstok
_mbsnextc
sprintf
difftime
_splitpath
_beginthread
_mbsrchr
_wcmdln
asin
_chsize
_errno
_strupr
strncat
__p__fmode
fseek
srand
iswprint
_CIsin
atof
iswalnum
strchr
__p__environ
strcoll
_wgetenv
_set_error_mode
__CxxFrameHandler
wcscpy
strcat
_stricmp
__lc_handle
?terminate@@YAXXZ

crypt32

CryptUnprotectData

advapi32

SetNamedSecurityInfoW
GetOldestEventLogRecord
ConvertStringSidToSidW
BuildTrusteeWithSidW
RegReplaceKeyA
SystemFunction005
SetKernelObjectSecurity
GetCurrentHwProfileA
AreAllAccessesGranted
SystemFunction031
DecryptFileW
SetSecurityDescriptorDacl
SystemFunction040
GetSecurityDescriptorLength
ControlTraceW
CryptDecrypt
SetNamedSecurityInfoA
UnregisterTraceGuids
ObjectCloseAuditAlarmA
IsTokenRestricted
AddAccessAllowedAce
EnableTrace
RevertToSelf
LsaClose
RegSetValueW
ImpersonateLoggedOnUser
CryptGenRandom
TreeResetNamedSecurityInfoW
RegDeleteKeyW
EnumServiceGroupW

shlwapi

SHRegCreateUSKeyW
PathAppendW
PathBuildRootW
StrRChrIW
PathCombineA
PathIsUNCA
StrCmpW
PathAddExtensionW
ChrCmpIA
StrRChrW
PathIsUNCServerW
PathStripPathW
StrFormatByteSizeW
StrPBrkW
StrChrNW
SHDeleteKeyA
PathCommonPrefixW
PathCompactPathA
PathUnquoteSpacesW
StrCatW
PathRemoveBackslashA
SHQueryInfoKeyW
PathIsSameRootW
StrStrNIW
StrToInt64ExW
SHRegDeleteUSValueW
StrCmpLogicalW

rasapi32

RasGetProjectionInfoW
RasGetCredentialsW
RasEnumConnectionsW
RasSetEapUserDataA
RasGetConnectStatusW
RasGetEntryPropertiesW
RasEnumDevicesW
RasValidateEntryNameW
RasSetSubEntryPropertiesW
RasGetEapUserDataW
RasSetCustomAuthDataW
RasFreeEapUserIdentityW
RasGetAutodialAddressW
RasHangUpW

kernel32

GetSystemDirectoryW
OpenEventW
GetPrivateProfileSectionNamesW
ScrollConsoleScreenBufferA
DeleteTimerQueueEx
HeapWalk
GetThreadContext
_lwrite
CreateThread
IsDBCSLeadByte
lstrlenW
ReadConsoleInputExA
LocalReAlloc
GetThreadSelectorEntry
SetConsoleMode
GlobalUnlock
VirtualAlloc
SetVolumeMountPointA
ResumeThread
lstrcmpiA
SetCurrentDirectoryA
GetVersion
FileTimeToLocalFileTime
GetPrivateProfileIntA
CreateJobObjectW
GetUserDefaultLangID

winspool.drv

OpenPrinterA
ConfigurePortW
OpenPrinterW
SetJobA
FindNextPrinterChangeNotification
EnumPrintersA
DeletePrintProcessorW
GetPrinterA
GetPrinterW
EndPagePrinter
SetFormW
DeletePrinter
DeletePrinterDriverW
AddPrinterDriverExW
GetPrintProcessorDirectoryW
EnumMonitorsW
EnumPrintersW

Sections

.text
Size: 36KB - Virtual size: 442KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 575KB - Virtual size: 981KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 160KB - Virtual size: 159KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

354073408d35e1d68bda539a0606a4f5

Headers

DLL Characteristics

File Characteristics

Imports

ntdsapi

msvcrt

crypt32

advapi32

shlwapi

rasapi32

kernel32

winspool.drv

Sections

.text Size: 36KB - Virtual size: 442KB

.data Size: 575KB - Virtual size: 981KB

.rsrc Size: 160KB - Virtual size: 159KB

.text
Size: 36KB - Virtual size: 442KB

.data
Size: 575KB - Virtual size: 981KB

.rsrc
Size: 160KB - Virtual size: 159KB