d4d7099e5f490fe591869f7d21c7230c8cbef90b0a2cd03b6e1d3ef3708dc238

Sharing

Copy URL

Twitter E-mail

General

Target

d4d7099e5f490fe591869f7d21c7230c8cbef90b0a2cd03b6e1d3ef3708dc238
Size

379KB
MD5

8824be8dc7c7b1fdc3c196696078b065
SHA1

8e8150f731ee3b4e24b7b80754986d302ee80fe2
SHA256

d4d7099e5f490fe591869f7d21c7230c8cbef90b0a2cd03b6e1d3ef3708dc238
SHA512

b04be4729a68167b2d75b1b0479f3c8b56789ffb3e5ab1a160241c4a65aa44bab1de15c264fead7e9522c8a9cfe6502a34caad5bf967c1ae31a14e297a86baae
SSDEEP

6144:iCVSyfgznk5omkKwA8TXConQosHI837z4JEcPATdPE1DFnX6:ZVSQLwA8T9NB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d4d7099e5f490fe591869f7d21c7230c8cbef90b0a2cd03b6e1d3ef3708dc238

Files

d4d7099e5f490fe591869f7d21c7230c8cbef90b0a2cd03b6e1d3ef3708dc238
.dll windows x86

0c832953065fcbd1825b3a830fcb3701

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

DbgPrint
LdrGetProcedureAddress
LdrLoadDll
LdrUnloadDll
NtAcceptConnectPort
NtAllocateVirtualMemory
NtClose
NtCompleteConnectPort
NtConnectPort
NtCreateEvent
NtCreateKey
NtCreatePort
NtCreateToken
NtDeleteKey
NtDeleteValueKey
NtDuplicateObject
NtFreeVirtualMemory
NtListenPort
NtOpenEvent
NtOpenKey
NtOpenProcess
NtOpenProcessToken
NtOpenThreadToken
NtQueryInformationToken
NtQueryKey
NtQuerySystemTime
NtReadVirtualMemory
NtReplyPort
NtReplyWaitReceivePort
NtRequestWaitReplyPort
NtSetEvent
NtWriteVirtualMemory
RtlAbsoluteToSelfRelativeSD
RtlAcquireResourceExclusive
RtlAcquireResourceShared
RtlAddAccessAllowedAce
RtlAddAccessDeniedAce
RtlAdjustPrivilege
RtlAllocateAndInitializeSid
RtlAllocateHeap
RtlCopyLuid
RtlCopyLuidAndAttributesArray
RtlCopySid
RtlCreateAcl
RtlCreateSecurityDescriptor
RtlEnterCriticalSection
RtlEqualSid
RtlEqualUnicodeString
RtlFreeHeap
RtlFreeSid
RtlGetNtProductType
RtlIdentifierAuthoritySid
RtlInitAnsiString
RtlInitUnicodeString
RtlInitializeCriticalSection
RtlInitializeResource
RtlInitializeSid
RtlLeaveCriticalSection
RtlLengthRequiredSid
RtlLengthSecurityDescriptor
RtlLengthSid
RtlMakeSelfRelativeSD
RtlQueryRegistryValues
RtlRaiseException
RtlReleaseResource
RtlSetDaclSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlSetSecurityObject
RtlSubAuthorityCountSid
RtlSubAuthoritySid
RtlUniform
RtlValidSecurityDescriptor
RtlValidSid
RtlValidateUnicodeString
RtlpNtOpenKey
RtlpNtQueryValueKey
RtlpNtSetValueKey
ZwCreateKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryValueKey
ZwSetValueKey
vDbgPrintExWithPrefix

advapi32

ConvertSidToStringSidW
EqualSid
GetLengthSid
I_ScIsSecurityProcess
LsaNtStatusToWinError
RegisterServiceCtrlHandlerW
SetServiceStatus
StartServiceCtrlDispatcherW

kernel32

CloseHandle
CreateEventW
CreateThread
DeleteCriticalSection
DisableThreadLibraryCalls
EnterCriticalSection
FindResourceW
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentVariableA
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryW
LoadResource
LocalAlloc
LocalFree
LocalReAlloc
LockResource
OpenEventW
QueryPerformanceCounter
RtlUnwind
SetEvent
SetLastError
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForSingleObject

msvcrt

__dllonexit
_amsg_exit
_initterm
_iob
_lock
_onexit
_strnicmp
_unlock
_vsnprintf
_wcsicmp
abort
bsearch
calloc
free
fwrite
memcmp
memmove
sprintf
strchr
strcmp
strcpy
strcspn
strncmp
vfprintf
wcschr
wcscpy
wcslen

rpcrt4

I_RpcMapWin32Status
NdrServerCall2
RpcImpersonateClient
RpcRevertToSelf
RpcServerListen
RpcServerRegisterIf
RpcServerUseProtseqEpW

samsrv

SamIConnect
SamIFree_SAMPR_RETURNED_USTRING_ARRAY
SamIFree_SAMPR_ULONG_ARRAY
SamrCloseHandle
SamrConnect
SamrGetAliasMembership
SamrLookupIdsInDomain
SamrLookupNamesInDomain
SamrOpenDomain

Exports

Exports

DsRolerDcAsDc
DsRolerDcAsReplica
DsRolerDemoteDc
DsRolerGetDcOperationProgress
DsRolerGetDcOperationResults
LsaIAddNameToLogonSession
LsaIAllocateHeap
LsaIAllocateHeapZero
LsaIAuditAccountLogon
LsaIAuditAccountLogonEx
LsaIAuditKdcEvent
LsaIAuditKerberosLogon
LsaIAuditLogonUsingExplicitCreds
LsaIAuditNotifyPackageLoad
LsaIAuditPasswordAccessEvent
LsaIAuditSamEvent
LsaICallPackage
LsaICallPackageEx
LsaICallPackagePassthrough
LsaICancelNotification
LsaIChangeSecretCipherKey
LsaICryptProtectData
LsaICryptUnprotectData
LsaIDsNotifiedObjectChange
LsaIEnumerateSecrets
LsaIEventNotify
LsaIFilterSids
LsaIForestTrustFindMatch
LsaIFreeForestTrustInfo
LsaIFreeHeap
LsaIFreeReturnBuffer
LsaIFree_LSAI_PRIVATE_DATA
LsaIFree_LSAI_SECRET_ENUM_BUFFER
LsaIFree_LSAPR_ACCOUNT_ENUM_BUFFER
LsaIFree_LSAPR_CR_CIPHER_VALUE
LsaIFree_LSAPR_POLICY_DOMAIN_INFORMATION
LsaIFree_LSAPR_POLICY_INFORMATION
LsaIFree_LSAPR_PRIVILEGE_ENUM_BUFFER
LsaIFree_LSAPR_PRIVILEGE_SET
LsaIFree_LSAPR_REFERENCED_DOMAIN_LIST
LsaIFree_LSAPR_SR_SECURITY_DESCRIPTOR
LsaIFree_LSAPR_TRANSLATED_NAMES
LsaIFree_LSAPR_TRANSLATED_SIDS
LsaIFree_LSAPR_TRUSTED_DOMAIN_INFO
LsaIFree_LSAPR_TRUSTED_ENUM_BUFFER
LsaIFree_LSAPR_TRUSTED_ENUM_BUFFER_EX
LsaIFree_LSAPR_TRUST_INFORMATION
LsaIFree_LSAPR_UNICODE_STRING
LsaIFree_LSAPR_UNICODE_STRING_BUFFER
LsaIFree_LSAP_SITENAME_INFO
LsaIFree_LSAP_SITE_INFO
LsaIFree_LSAP_SUBNET_INFO
LsaIFree_LSAP_UPN_SUFFIXES
LsaIFree_LSA_FOREST_TRUST_COLLISION_INFORMATION
LsaIFree_LSA_FOREST_TRUST_INFORMATION
LsaIGetBootOption
LsaIGetCallInfo
LsaIGetForestTrustInformation
LsaIGetLogonGuid
LsaIGetNbAndDnsDomainNames
LsaIGetPrivateData
LsaIGetSerialNumberPolicy
LsaIGetSerialNumberPolicy2
LsaIGetSiteName
LsaIHealthCheck
LsaIImpersonateClient
LsaIInitializeWellKnownSids
LsaIIsClassIdLsaClass
LsaIIsDsPaused
LsaIKerberosRegisterTrustNotification
LsaILookupWellKnownName
LsaINotifyChangeNotification
LsaINotifyNetlogonParametersChangeW
LsaINotifyPasswordChanged
LsaIOpenPolicyTrusted
LsaIQueryForestTrustInfo
LsaIQueryInformationPolicyTrusted
LsaIQuerySiteInfo
LsaIQuerySubnetInfo
LsaIQueryUpnSuffixes
LsaIRegisterNotification
LsaIRegisterPolicyChangeNotificationCallback
LsaISafeMode
LsaISamIndicatedDsStarted
LsaISetBootOption
LsaISetClientDnsHostName
LsaISetLogonGuidInLogonSession
LsaISetPrivateData
LsaISetSerialNumberPolicy
LsaISetTimesSecret
LsaISetupWasRun
LsaITestCall
LsaIUnregisterAllPolicyChangeNotificationCallback
LsaIUnregisterPolicyChangeNotificationCallback
LsaIUpdateForestTrustInformation
LsaIWriteAuditEvent
LsapAuOpenSam
LsapCheckBootMode
LsapDsDebugInitialize
LsapDsInitializeDsStateInfo
LsapDsInitializePromoteInterface
LsapInitLsa
LsarAddPrivilegesToAccount
LsarClose
LsarCreateAccount
LsarCreateSecret
LsarCreateTrustedDomain
LsarCreateTrustedDomainEx
LsarDelete
LsarEnumerateAccounts
LsarEnumeratePrivileges
LsarEnumeratePrivilegesAccount
LsarEnumerateTrustedDomains
LsarEnumerateTrustedDomainsEx
LsarGetQuotasForAccount
LsarGetSystemAccessAccount
LsarLookupNames
LsarLookupPrivilegeDisplayName
LsarLookupPrivilegeName
LsarLookupPrivilegeValue
LsarLookupSids
LsarLookupSids2
LsarOpenAccount
LsarOpenPolicy
LsarOpenPolicySce
LsarOpenSecret
LsarOpenTrustedDomain
LsarOpenTrustedDomainByName
LsarQueryDomainInformationPolicy
LsarQueryForestTrustInformation
LsarQueryInfoTrustedDomain
LsarQueryInformationPolicy
LsarQuerySecret
LsarQuerySecurityObject
LsarQueryTrustedDomainInfo
LsarQueryTrustedDomainInfoByName
LsarRemovePrivilegesFromAccount
LsarSetDomainInformationPolicy
LsarSetForestTrustInformation
LsarSetInformationPolicy
LsarSetInformationTrustedDomain
LsarSetQuotasForAccount
LsarSetSecret
LsarSetSecurityObject
LsarSetSystemAccessAccount
LsarSetTrustedDomainInfoByName
ServiceInit

Sections

.text
Size: 115KB - Virtual size: 115KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 824B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rossym
Size: 163KB - Virtual size: 163KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0c832953065fcbd1825b3a830fcb3701

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

advapi32

kernel32

msvcrt

rpcrt4

samsrv

Exports

Exports

Sections

.text Size: 115KB - Virtual size: 115KB

.data Size: 1024B - Virtual size: 824B

.rdata Size: 37KB - Virtual size: 37KB

.bss Size: - Virtual size: 5KB

.edata Size: 5KB - Virtual size: 5KB

.idata Size: 6KB - Virtual size: 5KB

.CRT Size: 512B - Virtual size: 44B

.tls Size: 512B - Virtual size: 8B

.rsrc Size: 38KB - Virtual size: 37KB

.reloc Size: 9KB - Virtual size: 8KB

.rossym Size: 163KB - Virtual size: 163KB

.text
Size: 115KB - Virtual size: 115KB

.data
Size: 1024B - Virtual size: 824B

.rdata
Size: 37KB - Virtual size: 37KB

.bss
Size: - Virtual size: 5KB

.edata
Size: 5KB - Virtual size: 5KB

.idata
Size: 6KB - Virtual size: 5KB

.CRT
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 8B

.rsrc
Size: 38KB - Virtual size: 37KB

.reloc
Size: 9KB - Virtual size: 8KB

.rossym
Size: 163KB - Virtual size: 163KB