b9416c77d62960bb81a95868fe98eb97f6170a2322556f774d9bc47e800e0d81

Sharing

Copy URL

Twitter E-mail

General

Target

b9416c77d62960bb81a95868fe98eb97f6170a2322556f774d9bc47e800e0d81
Size

340KB
MD5

893269bfe956ba5672efc9435afd0cfd
SHA1

f14007fe7646ee0e6496b3bef95236aac61d5d9d
SHA256

b9416c77d62960bb81a95868fe98eb97f6170a2322556f774d9bc47e800e0d81
SHA512

eb082525296e39a78de521011c3f4bb35ec17e8216d532ea98a0b751ab80908c5e3c89d5bbd1d1789c3395d6ed7b2ae6374bf8401197f79149df7e582b401b55
SSDEEP

6144:xzuTenW0rY6KfT53mdmVYsh08A8T3kOcc8GxHM:0tD0EYsh08A8TV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b9416c77d62960bb81a95868fe98eb97f6170a2322556f774d9bc47e800e0d81

Files

b9416c77d62960bb81a95868fe98eb97f6170a2322556f774d9bc47e800e0d81
.dll windows x86

58c7fd29202d3354a5f6543beafd687a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

DbgPrint
NtClose
NtDeleteKey
NtDeleteValueKey
NtOpenKey
NtQueryKey
NtQuerySystemTime
RtlAbsoluteToSelfRelativeSD
RtlAcquireResourceExclusive
RtlAcquireResourceShared
RtlAddAccessAllowedAce
RtlAddAuditAccessAce
RtlAllocateAndInitializeSid
RtlAllocateHeap
RtlAssert
RtlCreateAcl
RtlCreateSecurityDescriptor
RtlEqualUnicodeString
RtlFreeHeap
RtlFreeSid
RtlIdentifierAuthoritySid
RtlInitUnicodeString
RtlInitializeResource
RtlInitializeSid
RtlLengthRequiredSid
RtlLengthSecurityDescriptor
RtlLengthSid
RtlMakeSelfRelativeSD
RtlMapGenericMask
RtlRaiseException
RtlReleaseResource
RtlSetDaclSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlSetSaclSecurityDescriptor
RtlSetSecurityObject
RtlSubAuthorityCountSid
RtlSubAuthoritySid
RtlValidSecurityDescriptor
ZwCreateKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryValueKey
ZwSetValueKey
vDbgPrintExWithPrefix

advapi32

ConvertSidToStringSidW
LsaClose
LsaFreeMemory
LsaOpenPolicy
LsaQueryInformationPolicy
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
SystemFunction006
SystemFunction007
SystemFunction013

kernel32

DeleteCriticalSection
DisableThreadLibraryCalls
EnterCriticalSection
FindResourceW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentVariableA
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcessHeap
GetSystemTimeAsFileTime
GetTickCount
HeapAlloc
HeapFree
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryW
LoadResource
LocalAlloc
LocalFree
LocalReAlloc
LockResource
QueryPerformanceCounter
RtlUnwind
SetLastError
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery

msvcrt

__dllonexit
_amsg_exit
_initterm
_iob
_lock
_onexit
_unlock
_vsnprintf
abort
bsearch
calloc
free
fwrite
malloc
memcmp
memmove
sprintf
strchr
strcmp
strcpy
strcspn
strncmp
swprintf
vfprintf
wcscat
wcscpy
wcslen
wcstoul

rpcrt4

NdrServerCall2
RpcMgmtStopServerListening
RpcServerListen
RpcServerRegisterIf
RpcServerUseProtseqEpW

Exports

Exports

SamIAccountRestrictions
SamIAddDSNameToAlias
SamIAddDSNameToGroup
SamIAmIGC
SamIChangePasswordForeignUser
SamIChangePasswordForeignUser2
SamIConnect
SamICreateAccountByRid
SamIDemote
SamIDemoteUndo
SamIDoFSMORoleChange
SamIDsCreateObjectInDomain
SamIDsSetObjectInformation
SamIEnumerateAccountRids
SamIEnumerateInterdomainTrustAccountsForUpgrade
SamIFloatingSingleMasterOpEx
SamIFreeSidAndAttributesList
SamIFreeSidArray
SamIFreeVoid
SamIFree_SAMPR_ALIAS_INFO_BUFFER
SamIFree_SAMPR_DISPLAY_INFO_BUFFER
SamIFree_SAMPR_DOMAIN_INFO_BUFFER
SamIFree_SAMPR_ENUMERATION_BUFFER
SamIFree_SAMPR_GET_GROUPS_BUFFER
SamIFree_SAMPR_GET_MEMBERS_BUFFER
SamIFree_SAMPR_GROUP_INFO_BUFFER
SamIFree_SAMPR_PSID_ARRAY
SamIFree_SAMPR_RETURNED_USTRING_ARRAY
SamIFree_SAMPR_SR_SECURITY_DESCRIPTOR
SamIFree_SAMPR_ULONG_ARRAY
SamIFree_SAMPR_USER_INFO_BUFFER
SamIFree_UserInternal6Information
SamIGCLookupNames
SamIGCLookupSids
SamIGetAliasMembership
SamIGetBootKeyInformation
SamIGetDefaultAdministratorName
SamIGetFixedAttributes
SamIGetInterdomainTrustAccountPasswordsForUpgrade
SamIGetPrivateData
SamIGetResourceGroupMembershipsTransitive
SamIGetSerialNumberDomain
SamIGetUserLogonInformation
SamIGetUserLogonInformation2
SamIGetUserLogonInformationEx
SamIImpersonateNullSession
SamIIncrementPerformanceCounter
SamIInitialize
SamIIsDownlevelDcUpgrade
SamIIsExtendedSidMode
SamIIsRebootAfterPromotion
SamIIsSetupInProgress
SamILoadDownlevelDatabase
SamILoopbackConnect
SamIMixedDomain
SamIMixedDomain2
SamINT4UpgradeInProgress
SamINetLogonPing
SamINotifyDelta
SamINotifyRoleChange
SamINotifyServerDelta
SamIOpenAccount
SamIOpenUserByAlternateId
SamIPromote
SamIPromoteUndo
SamIQueryServerRole
SamIQueryServerRole2
SamIRelaceDownlevelDatabase
SamIRemoveDSNameFromAlias
SamIRemoveDSNameFromGroup
SamIResetBadPwdCountOnPdc
SamIRetrievePrimaryCredentials
SamIRevertNullSession
SamISameSite
SamISetAuditingInformation
SamISetMixedDomainFlag
SamISetPasswordForeignUser
SamISetPasswordForeignUser2
SamISetPasswordInfoOnPdc
SamISetPrivateData
SamISetSerialNumberDomain
SamIStorePrimaryCredentials
SamIUPNFromUserHandle
SamIUnLoadDownlevelDatabase
SamIUpdateLogonStatistics
SampAbortSingleLoopbackTask
SampAccountControlToFlags
SampAcquireSamLockExclusive
SampAcquireWriteLock
SampCommitBufferedWrites
SampConvertNt4SdToNt5Sd
SampDsChangePasswordUser
SampFlagsToAccountControl
SampGetDefaultSecurityDescriptorForClass
SampGetSerialNumberDomain2
SampInitializeRegistry
SampInitializeSdConversion
SampInvalidateDomainCache
SampInvalidateRidRange
SampNetLogonNotificationRequired
SampNotifyReplicatedInChange
SampProcessSingleLoopbackTask
SampReleaseSamLockExclusive
SampReleaseWriteLock
SampRtlConvertUlongToUnicodeString
SampSetSerialNumberDomain2
SampUsingDsData
SampWriteGroupType
SamrAddMemberToAlias
SamrAddMemberToGroup
SamrAddMultipleMembersToAlias
SamrChangePasswordUser
SamrCloseHandle
SamrConnect
SamrCreateAliasInDomain
SamrCreateGroupInDomain
SamrCreateUser2InDomain
SamrCreateUserInDomain
SamrDeleteAlias
SamrDeleteGroup
SamrDeleteUser
SamrEnumerateAliasesInDomain
SamrEnumerateDomainsInSamServer
SamrEnumerateGroupsInDomain
SamrEnumerateUsersInDomain
SamrGetAliasMembership
SamrGetGroupsForUser
SamrGetMembersInAlias
SamrGetMembersInGroup
SamrGetUserDomainPasswordInformation
SamrLookupDomainInSamServer
SamrLookupIdsInDomain
SamrLookupNamesInDomain
SamrOpenAlias
SamrOpenDomain
SamrOpenGroup
SamrOpenUser
SamrQueryDisplayInformation
SamrQueryInformationAlias
SamrQueryInformationDomain
SamrQueryInformationGroup
SamrQueryInformationUser
SamrQuerySecurityObject
SamrRemoveMemberFromAlias
SamrRemoveMemberFromForeignDomain
SamrRemoveMemberFromGroup
SamrRemoveMultipleMembersFromAlias
SamrRidToSid
SamrSetInformationAlias
SamrSetInformationDomain
SamrSetInformationGroup
SamrSetInformationUser
SamrSetMemberAttributesOfGroup
SamrSetSecurityObject
SamrShutdownSamServer
SamrTestPrivateFunctionsDomain
SamrTestPrivateFunctionsUser
SamrUnicodeChangePasswordUser2

Sections

.text
Size: 126KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 696B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rossym
Size: 141KB - Virtual size: 141KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

58c7fd29202d3354a5f6543beafd687a

Headers

File Characteristics

Imports

ntdll

advapi32

kernel32

msvcrt

rpcrt4

Exports

Exports

Sections

.text Size: 126KB - Virtual size: 126KB

.data Size: 1024B - Virtual size: 696B

.rdata Size: 30KB - Virtual size: 30KB

/4 Size: 512B - Virtual size: 20B

.bss Size: - Virtual size: 5KB

.edata Size: 5KB - Virtual size: 5KB

.idata Size: 4KB - Virtual size: 3KB

.CRT Size: 512B - Virtual size: 44B

.tls Size: 512B - Virtual size: 8B

.rsrc Size: 17KB - Virtual size: 17KB

.reloc Size: 10KB - Virtual size: 9KB

.rossym Size: 141KB - Virtual size: 141KB

.text
Size: 126KB - Virtual size: 126KB

.data
Size: 1024B - Virtual size: 696B

.rdata
Size: 30KB - Virtual size: 30KB

/4
Size: 512B - Virtual size: 20B

.bss
Size: - Virtual size: 5KB

.edata
Size: 5KB - Virtual size: 5KB

.idata
Size: 4KB - Virtual size: 3KB

.CRT
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 8B

.rsrc
Size: 17KB - Virtual size: 17KB

.reloc
Size: 10KB - Virtual size: 9KB

.rossym
Size: 141KB - Virtual size: 141KB