e780c81c90625ee26a5061f8ae99f29aa3280998c6c716719fab571897fc650f

Sharing

Copy URL Twitter E-mail

General

Target

e780c81c90625ee26a5061f8ae99f29aa3280998c6c716719fab571897fc650f
Size

92KB
MD5

0e74519a993c0cbdfc9953f74480b268
SHA1

222e5706ec386a0ad4c879165facffccf181c9d0
SHA256

e780c81c90625ee26a5061f8ae99f29aa3280998c6c716719fab571897fc650f
SHA512

4202a6a1912441202381b524cda998a274eaf0fe9d8a2afb7c09fa35e585581e9276d41d9813ac0239d6498b7c1fc16e99c778d8590937d010d36eee0af1b619
SSDEEP

1536:DrqLkOza7MZahq0dzAvypcX+JYEa0vyuZp7wHaHXbHhUVjiI9nD4DHCOaazXNL3:DGL3zMVqvVwYZ0zvf8GI9nDyilEL

Score

N/A

Malware Config

Signatures

Files

e780c81c90625ee26a5061f8ae99f29aa3280998c6c716719fab571897fc650f
.exe windows x86

b6e10f175f2d892b13a560e8a9d2f2c5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msls31

LssbFDoneDisplay
LsResetRMInCurrentSubline
LsdnSubmitSublines
LsCompressSubline
LsForceBreakSubline
LsPointUV2FromPointUV1

rpcrt4

UuidToStringA
RpcStringBindingComposeA
NdrSimpleTypeUnmarshall
RpcSmSetThreadHandle
NdrNonEncapsulatedUnionBufferSize
RpcErrorEndEnumeration
NdrComplexArrayMarshall
I_RpcBindingInqDynamicEndpoint
RpcServerUseProtseqEpA
NdrConformantVaryingStructUnmarshall
NdrConformantArrayMarshall
NdrUserMarshalMemorySize
NdrCorrelationPass
RpcStringBindingParseA
NDRSContextMarshallEx
NdrNonEncapsulatedUnionFree
NdrRpcSsDefaultFree
RpcNetworkIsProtseqValidW
NdrCreateServerInterfaceFromStub
RpcTestCancel
I_RpcTransIoCancelled
NdrServerContextUnmarshall
RpcServerUseProtseqIfExW
RpcServerUseProtseqExW
I_RpcClearMutex
NdrpGetTypeGenCookie
RpcSsGetContextBinding
RpcSmClientFree
NdrDllCanUnloadNow
RpcMgmtStatsVectorFree
RpcNetworkInqProtseqsW
NdrConformantStructUnmarshall
RpcBindingFree
NdrConformantVaryingStructMemorySize
RpcCancelThreadEx
RpcGetAuthorizationContextForClient
NdrServerContextNewMarshall
NdrConformantVaryingStructMarshall
NdrRpcSsDisableAllocate
NdrXmitOrRepAsBufferSize
NdrStubForwardingFunction
NdrSimpleStructMarshall

wldap32

ldap_modify_ext_sW
ldap_bindA
ldap_simple_bindA
ldap_err2stringA
ldap_next_reference
ldap_get_values_lenA
ldap_delete
ber_peek_tag
ldap_create_page_controlA
ldap_control_free
ldap_create_vlv_controlA
ldap_rename_extA
ldap_modify_extW
ldap_parse_page_control
ldap_addW
ldap_create_sort_controlW
ldap_search_s
ldap_search_init_pageW
ldap_search_abandon_page
ldap_parse_page_controlW
ldap_sslinitW
ldap_control_freeW
ldap_add_extW
ldap_simple_bind_sA

advapi32

GetAccessPermissionsForObjectW
ElfOpenBackupEventLogA
PrivilegedServiceAuditAlarmW
AddAuditAccessAce
CryptDeriveKey
EncryptFileA
GetInformationCodeAuthzLevelW
GetUserNameW
MD5Init
CredpDecodeCredential
CredEnumerateW
GetTrusteeNameA
WmiOpenBlock
GetAclInformation
QueryAllTracesW
CredMarshalCredentialW
LsaEnumerateAccountRights
GetSidSubAuthorityCount
LsaGetQuotasForAccount
CommandLineFromMsiDescriptor
CredUnmarshalCredentialW
CredReadDomainCredentialsA
RegUnLoadKeyW
CryptCreateHash
ElfReportEventA
LsaQueryTrustedDomainInfoByName
EnumDependentServicesA
RegConnectRegistryW
SystemFunction004
ImpersonateLoggedOnUser
CryptDuplicateHash
RegSaveKeyA
WmiQuerySingleInstanceMultipleW
CryptVerifySignatureA
MakeAbsoluteSD2
LsaSetSecurityObject
ElfReadEventLogW
LsaRetrievePrivateData
CloseTrace
SystemFunction026
SaferiRecordEventLogEntry
CredpEncodeCredential
StopTraceW
GetLocalManagedApplications
ObjectCloseAuditAlarmW
SystemFunction002
RegSaveKeyW
SetSecurityInfo
RegReplaceKeyW
RegCreateKeyA
GetAccessPermissionsForObjectA
BuildTrusteeWithObjectsAndSidA
AddAccessAllowedAce
SetTokenInformation
CryptGetDefaultProviderA
StartServiceCtrlDispatcherW
CryptEncrypt
CryptContextAddRef
ObjectDeleteAuditAlarmW
RegReplaceKeyA

winmm

mmioWrite
mciDriverYield
mciGetDeviceIDW
auxGetDevCapsA
waveOutGetErrorTextW
waveOutMessage
midiInGetDevCapsW
waveInClose
midiOutSetVolume
auxGetVolume
joyGetDevCapsW
midiInOpen
waveInReset

olecli32

LeEqual
ErrSetTargetDevice
LeSetBounds
PbEnumFormats
SetNextNetDrive
LeObjectLong
OleCreateFromFile
OleRevokeClientDoc
ErrExecute
OleQueryOpen
GenSaveToStream
DefCreateFromFile
DibGetData
MfCallbackFunc
ErrUpdate
ErrGetUpdateOptions
PbCreate
OleEnumFormats
WEP
ErrCopyFromLink
CheckNetDrive
MfRelease

odbc32

SQLProcedures
CursorLibLockStmt
SQLPrepareA
SQLSpecialColumns
SQLCopyDesc
SQLColAttributesA
SQLStatisticsA
SQLPrimaryKeysA
SQLGetCursorNameA
SQLSetStmtAttrA
SQLNativeSqlA
SQLDriverConnectW
SQLTablePrivilegesW
SQLGetConnectAttr
SQLGetDiagFieldA
SQLProcedureColumnsA
SQLSetConnectOptionA

kernel32

VirtualAllocEx
GetStartupInfoW
GetVersionExW
GetExpandedNameW
GetTimeFormatA
GetNumberOfConsoleFonts
WriteFileEx
SetConsoleInputExeNameW
WritePrivateProfileStructW
Heap32Next
DeleteFiber
GetThreadLocale
GetFullPathNameW
GlobalUnfix
FindNextVolumeMountPointA
GetProcessHeaps
GlobalWire
GetLocaleInfoW
GetProcessWorkingSetSize
GetNativeSystemInfo
RequestDeviceWakeup
WriteConsoleW
FlushFileBuffers
_hwrite
GetModuleFileNameA
WriteTapemark
ReleaseSemaphore
EnumUILanguagesA
FlushInstructionCache
EnumSystemLanguageGroupsW
GetNextVDMCommand
GetComputerNameA
GetLastError
GetDriveTypeW
UnmapViewOfFile
SetTapePosition
MoveFileW
CreateNamedPipeW
ReadConsoleInputExA
SetConsoleWindowInfo
GetCurrencyFormatW
ReadConsoleOutputCharacterA
GetCommState
VirtualLock
IsBadHugeReadPtr
GetCPInfoExW
LZCopy
IsSystemResumeAutomatic
SetHandleCount
LZDone
lstrcpy
SetConsoleTextAttribute
_lwrite
FindFirstFileA
GetConsoleDisplayMode
OpenJobObjectA
GlobalFindAtomW
GetVersion
DosDateTimeToFileTime
lstrcpyW
EnumTimeFormatsA
LocalReAlloc
IsBadWritePtr
GlobalFree
ChangeTimerQueueTimer
WaitForDebugEvent
MulDiv

ws2_32

getsockname
gethostbyaddr
WSADuplicateSocketW
WSADuplicateSocketA
WSALookupServiceEnd
getprotobynumber
WSASetBlockingHook
htons
sendto
WSAEventSelect
WSAIsBlocking

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 55KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b6e10f175f2d892b13a560e8a9d2f2c5

Headers

File Characteristics

Imports

msls31

rpcrt4

wldap32

advapi32

winmm

olecli32

odbc32

kernel32

ws2_32

Sections

.text Size: 26KB - Virtual size: 25KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 55KB - Virtual size: 93KB

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: 26KB - Virtual size: 25KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 55KB - Virtual size: 93KB

.rsrc
Size: 1KB - Virtual size: 1KB