581796a4c42bfd971045436f5ca4335e3557efca7e20b2711a41a83827920168

Sharing

Copy URL Twitter E-mail

General

Target

581796a4c42bfd971045436f5ca4335e3557efca7e20b2711a41a83827920168
Size

348KB
MD5

416626a8ca366c557b5770d66e9b81eb
SHA1

c1e6899436e6d0ab7929e7f74486df94540bbd67
SHA256

581796a4c42bfd971045436f5ca4335e3557efca7e20b2711a41a83827920168
SHA512

2177de16580549c9904ef0f68cd161b591e8217fcbce749db5a38e4f9568f30c396cc8e9cec5c4a7b6a9b1b1fdb21dec472872fff31ffb609ce2da47768af1c2
SSDEEP

6144:Jp/p8nnBho7qOxazOYSiwQ9959r8x1GnkYI0IdSy6tx7cPe:7GnnBGm/wQ9959r8aJR7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
581796a4c42bfd971045436f5ca4335e3557efca7e20b2711a41a83827920168

Files

581796a4c42bfd971045436f5ca4335e3557efca7e20b2711a41a83827920168
.dll windows x86

5bf80781d0ab8652d03d8fb317c6ccc0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

DbgPrint
LdrGetProcedureAddress
LdrLoadDll
LdrUnloadDll
NtAcceptConnectPort
NtAllocateVirtualMemory
NtClose
NtCompleteConnectPort
NtConnectPort
NtCreateEvent
NtCreateKey
NtCreatePort
NtCreateToken
NtDeleteKey
NtDeleteValueKey
NtDuplicateObject
NtFreeVirtualMemory
NtListenPort
NtOpenEvent
NtOpenKey
NtOpenProcess
NtOpenProcessToken
NtOpenThreadToken
NtQueryInformationToken
NtQueryKey
NtQuerySystemTime
NtReadVirtualMemory
NtReplyPort
NtReplyWaitReceivePort
NtRequestWaitReplyPort
NtSetEvent
NtWriteVirtualMemory
RtlAbsoluteToSelfRelativeSD
RtlAcquireResourceExclusive
RtlAcquireResourceShared
RtlAddAccessAllowedAce
RtlAddAccessDeniedAce
RtlAdjustPrivilege
RtlAllocateAndInitializeSid
RtlAllocateHeap
RtlCopyLuid
RtlCopyLuidAndAttributesArray
RtlCopySid
RtlCreateAcl
RtlCreateSecurityDescriptor
RtlEnterCriticalSection
RtlEqualSid
RtlEqualUnicodeString
RtlFreeHeap
RtlFreeSid
RtlGetNtProductType
RtlIdentifierAuthoritySid
RtlInitAnsiString
RtlInitUnicodeString
RtlInitializeCriticalSection
RtlInitializeResource
RtlInitializeSid
RtlLeaveCriticalSection
RtlLengthRequiredSid
RtlLengthSecurityDescriptor
RtlLengthSid
RtlMakeSelfRelativeSD
RtlQueryRegistryValues
RtlRaiseException
RtlReleaseResource
RtlSetDaclSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlSetSecurityObject
RtlSubAuthorityCountSid
RtlSubAuthoritySid
RtlUniform
RtlValidSecurityDescriptor
RtlValidSid
RtlValidateUnicodeString
RtlpNtOpenKey
RtlpNtQueryValueKey
RtlpNtSetValueKey
ZwCreateKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryValueKey
ZwSetValueKey
vDbgPrintExWithPrefix

advapi32

ConvertSidToStringSidW
EqualSid
GetLengthSid
I_ScIsSecurityProcess
LsaNtStatusToWinError
RegisterServiceCtrlHandlerW
SetServiceStatus
StartServiceCtrlDispatcherW

kernel32

CloseHandle
CreateEventW
CreateThread
DeleteCriticalSection
DisableThreadLibraryCalls
EnterCriticalSection
FindResourceW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentVariableA
GetLastError
GetModuleHandleA
GetModuleHandleW
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryW
LoadResource
LocalAlloc
LocalFree
LocalReAlloc
LockResource
OpenEventW
QueryPerformanceCounter
RtlUnwind
SetEvent
SetLastError
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForSingleObject

msvcrt

__dllonexit
_amsg_exit
_initterm
_iob
_lock
_onexit
_strnicmp
_unlock
_vsnprintf
_wcsicmp
abort
bsearch
calloc
free
fwrite
malloc
memcmp
memmove
sprintf
strchr
strcmp
strcpy
strcspn
strncmp
vfprintf
wcschr
wcscpy
wcslen

rpcrt4

I_RpcMapWin32Status
NdrServerCall2
RpcImpersonateClient
RpcRevertToSelf
RpcServerListen
RpcServerRegisterIf
RpcServerUseProtseqEpW

samsrv

SamIConnect
SamIFree_SAMPR_RETURNED_USTRING_ARRAY
SamIFree_SAMPR_ULONG_ARRAY
SamrCloseHandle
SamrConnect
SamrGetAliasMembership
SamrLookupIdsInDomain
SamrLookupNamesInDomain
SamrOpenDomain

Exports

Exports

DsRolerDcAsDc
DsRolerDcAsReplica
DsRolerDemoteDc
DsRolerGetDcOperationProgress
DsRolerGetDcOperationResults
LsaIAddNameToLogonSession
LsaIAllocateHeap
LsaIAllocateHeapZero
LsaIAuditAccountLogon
LsaIAuditAccountLogonEx
LsaIAuditKdcEvent
LsaIAuditKerberosLogon
LsaIAuditLogonUsingExplicitCreds
LsaIAuditNotifyPackageLoad
LsaIAuditPasswordAccessEvent
LsaIAuditSamEvent
LsaICallPackage
LsaICallPackageEx
LsaICallPackagePassthrough
LsaICancelNotification
LsaIChangeSecretCipherKey
LsaICryptProtectData
LsaICryptUnprotectData
LsaIDsNotifiedObjectChange
LsaIEnumerateSecrets
LsaIEventNotify
LsaIFilterSids
LsaIForestTrustFindMatch
LsaIFreeForestTrustInfo
LsaIFreeHeap
LsaIFreeReturnBuffer
LsaIFree_LSAI_PRIVATE_DATA
LsaIFree_LSAI_SECRET_ENUM_BUFFER
LsaIFree_LSAPR_ACCOUNT_ENUM_BUFFER
LsaIFree_LSAPR_CR_CIPHER_VALUE
LsaIFree_LSAPR_POLICY_DOMAIN_INFORMATION
LsaIFree_LSAPR_POLICY_INFORMATION
LsaIFree_LSAPR_PRIVILEGE_ENUM_BUFFER
LsaIFree_LSAPR_PRIVILEGE_SET
LsaIFree_LSAPR_REFERENCED_DOMAIN_LIST
LsaIFree_LSAPR_SR_SECURITY_DESCRIPTOR
LsaIFree_LSAPR_TRANSLATED_NAMES
LsaIFree_LSAPR_TRANSLATED_SIDS
LsaIFree_LSAPR_TRUSTED_DOMAIN_INFO
LsaIFree_LSAPR_TRUSTED_ENUM_BUFFER
LsaIFree_LSAPR_TRUSTED_ENUM_BUFFER_EX
LsaIFree_LSAPR_TRUST_INFORMATION
LsaIFree_LSAPR_UNICODE_STRING
LsaIFree_LSAPR_UNICODE_STRING_BUFFER
LsaIFree_LSAP_SITENAME_INFO
LsaIFree_LSAP_SITE_INFO
LsaIFree_LSAP_SUBNET_INFO
LsaIFree_LSAP_UPN_SUFFIXES
LsaIFree_LSA_FOREST_TRUST_COLLISION_INFORMATION
LsaIFree_LSA_FOREST_TRUST_INFORMATION
LsaIGetBootOption
LsaIGetCallInfo
LsaIGetForestTrustInformation
LsaIGetLogonGuid
LsaIGetNbAndDnsDomainNames
LsaIGetPrivateData
LsaIGetSerialNumberPolicy
LsaIGetSerialNumberPolicy2
LsaIGetSiteName
LsaIHealthCheck
LsaIImpersonateClient
LsaIInitializeWellKnownSids
LsaIIsClassIdLsaClass
LsaIIsDsPaused
LsaIKerberosRegisterTrustNotification
LsaILookupWellKnownName
LsaINotifyChangeNotification
LsaINotifyNetlogonParametersChangeW
LsaINotifyPasswordChanged
LsaIOpenPolicyTrusted
LsaIQueryForestTrustInfo
LsaIQueryInformationPolicyTrusted
LsaIQuerySiteInfo
LsaIQuerySubnetInfo
LsaIQueryUpnSuffixes
LsaIRegisterNotification
LsaIRegisterPolicyChangeNotificationCallback
LsaISafeMode
LsaISamIndicatedDsStarted
LsaISetBootOption
LsaISetClientDnsHostName
LsaISetLogonGuidInLogonSession
LsaISetPrivateData
LsaISetSerialNumberPolicy
LsaISetTimesSecret
LsaISetupWasRun
LsaITestCall
LsaIUnregisterAllPolicyChangeNotificationCallback
LsaIUnregisterPolicyChangeNotificationCallback
LsaIUpdateForestTrustInformation
LsaIWriteAuditEvent
LsapAuOpenSam
LsapCheckBootMode
LsapDsDebugInitialize
LsapDsInitializeDsStateInfo
LsapDsInitializePromoteInterface
LsapInitLsa
LsarAddPrivilegesToAccount
LsarClose
LsarCreateAccount
LsarCreateSecret
LsarCreateTrustedDomain
LsarCreateTrustedDomainEx
LsarDelete
LsarEnumerateAccounts
LsarEnumeratePrivileges
LsarEnumeratePrivilegesAccount
LsarEnumerateTrustedDomains
LsarEnumerateTrustedDomainsEx
LsarGetQuotasForAccount
LsarGetSystemAccessAccount
LsarLookupNames
LsarLookupPrivilegeDisplayName
LsarLookupPrivilegeName
LsarLookupPrivilegeValue
LsarLookupSids
LsarLookupSids2
LsarOpenAccount
LsarOpenPolicy
LsarOpenPolicySce
LsarOpenSecret
LsarOpenTrustedDomain
LsarOpenTrustedDomainByName
LsarQueryDomainInformationPolicy
LsarQueryForestTrustInformation
LsarQueryInfoTrustedDomain
LsarQueryInformationPolicy
LsarQuerySecret
LsarQuerySecurityObject
LsarQueryTrustedDomainInfo
LsarQueryTrustedDomainInfoByName
LsarRemovePrivilegesFromAccount
LsarSetDomainInformationPolicy
LsarSetForestTrustInformation
LsarSetInformationPolicy
LsarSetInformationTrustedDomain
LsarSetQuotasForAccount
LsarSetSecret
LsarSetSecurityObject
LsarSetSystemAccessAccount
LsarSetTrustedDomainInfoByName
ServiceInit

Sections

.text
Size: 111KB - Virtual size: 110KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 824B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rossym
Size: 139KB - Virtual size: 138KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5bf80781d0ab8652d03d8fb317c6ccc0

Headers

File Characteristics

Imports

ntdll

advapi32

kernel32

msvcrt

rpcrt4

samsrv

Exports

Exports

Sections

.text Size: 111KB - Virtual size: 110KB

.data Size: 1024B - Virtual size: 824B

.rdata Size: 36KB - Virtual size: 35KB

/4 Size: 512B - Virtual size: 20B

.bss Size: - Virtual size: 5KB

.edata Size: 5KB - Virtual size: 5KB

.idata Size: 6KB - Virtual size: 5KB

.CRT Size: 512B - Virtual size: 44B

.tls Size: 512B - Virtual size: 8B

.rsrc Size: 38KB - Virtual size: 37KB

.reloc Size: 8KB - Virtual size: 8KB

.rossym Size: 139KB - Virtual size: 138KB

.text
Size: 111KB - Virtual size: 110KB

.data
Size: 1024B - Virtual size: 824B

.rdata
Size: 36KB - Virtual size: 35KB

/4
Size: 512B - Virtual size: 20B

.bss
Size: - Virtual size: 5KB

.edata
Size: 5KB - Virtual size: 5KB

.idata
Size: 6KB - Virtual size: 5KB

.CRT
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 8B

.rsrc
Size: 38KB - Virtual size: 37KB

.reloc
Size: 8KB - Virtual size: 8KB

.rossym
Size: 139KB - Virtual size: 138KB