General

Malware Config

Signatures

Files

• 9a48990bebc25b16ec4289702ce64135de6c1c2682b95ee74969f6d6a1266bb1

  .zip
• AdFind.exe

  .exe windows x86

  d144de8117df2beceaba2201ad304764

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  crypt32

  CertNameToStrA

  CertFreeCertificateContext

  CryptDecodeObjectEx

  version

  VerQueryValueW

  GetFileVersionInfoW

  GetFileVersionInfoSizeW

  advapi32

  IsValidSecurityDescriptor

  ConvertSecurityDescriptorToStringSecurityDescriptorA

  LsaLookupSids

  LsaFreeMemory

  ConvertSidToStringSidA

  GetSidSubAuthorityCount

  GetSidSubAuthority

  GetSidIdentifierAuthority

  GetSecurityDescriptorLength

  LsaOpenPolicy

  GetLengthSid

  ConvertStringSidToSidA

  GetSecurityDescriptorOwner

  LookupAccountSidA

  IsValidSid

  ConvertStringSidToSidW

  wldap32

  ord309

  ord215

  ord139

  ord132

  ord12

  ord216

  ord178

  ord77

  ord141

  ord207

  ord96

  ord146

  ord223

  ord310

  ord41

  ord218

  ord135

  ord311

  ord72

  ord304

  ord191

  ord14

  ord147

  ord166

  ord79

  ord36

  ord330

  ord27

  ord121

  ord13

  ord54

  ord55

  ord205

  ord26

  ord117

  ord119

  ord126

  ord301

  ord93

  ord73

  ord196

  ord300

  ws2_32

  ntohs

  kernel32

  SetEndOfFile

  WriteConsoleW

  HeapSize

  SetStdHandle

  GetProcessHeap

  SetEnvironmentVariableW

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetOEMCP

  GetACP

  IsValidCodePage

  FindNextFileW

  FindFirstFileExW

  FindClose

  HeapReAlloc

  ReadFile

  ReadConsoleW

  ReadConsoleInputW

  SetConsoleMode

  CreateFileW

  DeleteFileW

  GetConsoleMode

  GetConsoleOutputCP

  FlushFileBuffers

  EnumSystemLocalesW

  IsValidLocale

  GetLocaleInfoW

  CompareStringW

  HeapFree

  HeapAlloc

  SetFilePointerEx

  GetFileSizeEx

  GetCommandLineW

  GetCommandLineA

  WriteFile

  GetModuleFileNameW

  GetConsoleCP

  GetModuleHandleExW

  ExitProcess

  LoadLibraryExW

  TlsFree

  TlsSetValue

  TlsGetValue

  TlsAlloc

  SetLastError

  RaiseException

  GetModuleFileNameA

  GetFileAttributesExA

  SetConsoleTitleA

  GetCurrentProcess

  lstrlenW

  GetStdHandle

  MultiByteToWideChar

  Sleep

  FormatMessageW

  GetTimeZoneInformation

  LocalFileTimeToFileTime

  GetLastError

  GetFileAttributesA

  QueryFullProcessImageNameA

  FileTimeToSystemTime

  GetConsoleTitleA

  FileTimeToLocalFileTime

  LocalFree

  SystemTimeToFileTime

  WideCharToMultiByte

  CreateProcessA

  GetFileType

  CreateDirectoryA

  GetSystemTime

  GetTickCount

  RtlUnwind

  InitializeSListHead

  GetSystemTimeAsFileTime

  GetCurrentThreadId

  GetStringTypeW

  EnterCriticalSection

  LeaveCriticalSection

  InitializeCriticalSectionEx

  DeleteCriticalSection

  EncodePointer

  DecodePointer

  LCMapStringEx

  GetCPInfo

  FreeLibrary

  LoadLibraryA

  LCMapStringW

  LCMapStringA

  GetUserDefaultLCID

  GetStringTypeExA

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TerminateProcess

  IsProcessorFeaturePresent

  CloseHandle

  InitializeCriticalSectionAndSpinCount

  SetEvent

  ResetEvent

  WaitForSingleObjectEx

  CreateEventW

  GetModuleHandleW

  GetProcAddress

  IsDebuggerPresent

  GetStartupInfoW

  QueryPerformanceCounter

  GetCurrentProcessId

  ole32

  CLSIDFromString

  StringFromGUID2

  user32

  LoadStringA

  Sections

  .text

  Size: 1.5MB - Virtual size: 1.5MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 433KB - Virtual size: 432KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 8KB - Virtual size: 1.0MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 6KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 79KB - Virtual size: 79KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• adcsv.pl