ce448ab84b2642a446fa97b022bc8754bee60f0bd2689fe63a3f3c8492ad40b6

Sharing

Copy URL

Twitter E-mail

General

Target

ce448ab84b2642a446fa97b022bc8754bee60f0bd2689fe63a3f3c8492ad40b6
Size

390KB
MD5

ad28cf4b79339dabc7f971b622927caa
SHA1

fe2fc1cd0dd4d3b7a150793db43fe0416efb1a4b
SHA256

ce448ab84b2642a446fa97b022bc8754bee60f0bd2689fe63a3f3c8492ad40b6
SHA512

1ce2fa6ce2f4bc61da1da4c66d5b7b02a8aec30717980e5c2995239cc272cc445838cf513ea0dff6e4d733f995d25e2d049027ceb417e26651b2d157a46a14b1
SSDEEP

6144:aFfAzYcrZUESndAT5i4ZnEVK/N/O6VL8KE/lvGfijS7NMKCkAgcJUkJA5pg4m4yf:aFBcrZUESndAT5UcpghyA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ce448ab84b2642a446fa97b022bc8754bee60f0bd2689fe63a3f3c8492ad40b6

Files

ce448ab84b2642a446fa97b022bc8754bee60f0bd2689fe63a3f3c8492ad40b6
.dll windows x86

d36ba8acd194f254f19505046b1f1c48

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

DbgPrint
NtClose
NtDeleteKey
NtDeleteValueKey
NtOpenKey
NtQueryKey
NtQuerySystemTime
RtlAbsoluteToSelfRelativeSD
RtlAcquireResourceExclusive
RtlAcquireResourceShared
RtlAddAccessAllowedAce
RtlAddAuditAccessAce
RtlAllocateAndInitializeSid
RtlAllocateHeap
RtlAssert
RtlCreateAcl
RtlCreateSecurityDescriptor
RtlEqualUnicodeString
RtlFreeHeap
RtlFreeSid
RtlGetNtProductType
RtlIdentifierAuthoritySid
RtlInitUnicodeString
RtlInitializeResource
RtlInitializeSid
RtlLengthRequiredSid
RtlLengthSecurityDescriptor
RtlLengthSid
RtlMakeSelfRelativeSD
RtlMapGenericMask
RtlRaiseException
RtlReleaseResource
RtlSetDaclSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlSetSaclSecurityDescriptor
RtlSetSecurityObject
RtlSubAuthorityCountSid
RtlSubAuthoritySid
RtlValidSecurityDescriptor
ZwCreateKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryValueKey
ZwSetValueKey
vDbgPrintExWithPrefix

advapi32

ConvertSidToStringSidW
LsaClose
LsaFreeMemory
LsaOpenPolicy
LsaQueryInformationPolicy
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
SystemFunction006
SystemFunction007
SystemFunction013

kernel32

DeleteCriticalSection
DisableThreadLibraryCalls
EnterCriticalSection
FindResourceW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentVariableA
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcessHeap
GetSystemTimeAsFileTime
GetTickCount
HeapAlloc
HeapFree
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryW
LoadResource
LocalAlloc
LocalFree
LocalReAlloc
LockResource
QueryPerformanceCounter
RtlUnwind
SetLastError
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery

msvcrt

__dllonexit
_amsg_exit
_initterm
_iob
_lock
_onexit
_unlock
_vsnprintf
abort
bsearch
calloc
free
fwrite
memcmp
memmove
sprintf
strchr
strcmp
strcpy
strcspn
strncmp
swprintf
vfprintf
wcscat
wcscpy
wcslen
wcstoul

rpcrt4

NdrServerCall2
RpcMgmtStopServerListening
RpcServerListen
RpcServerRegisterIf
RpcServerUseProtseqEpW

Exports

Exports

SamIAccountRestrictions
SamIAddDSNameToAlias
SamIAddDSNameToGroup
SamIAmIGC
SamIChangePasswordForeignUser
SamIChangePasswordForeignUser2
SamIConnect
SamICreateAccountByRid
SamIDemote
SamIDemoteUndo
SamIDoFSMORoleChange
SamIDsCreateObjectInDomain
SamIDsSetObjectInformation
SamIEnumerateAccountRids
SamIEnumerateInterdomainTrustAccountsForUpgrade
SamIFloatingSingleMasterOpEx
SamIFreeSidAndAttributesList
SamIFreeSidArray
SamIFreeVoid
SamIFree_SAMPR_ALIAS_INFO_BUFFER
SamIFree_SAMPR_DISPLAY_INFO_BUFFER
SamIFree_SAMPR_DOMAIN_INFO_BUFFER
SamIFree_SAMPR_ENUMERATION_BUFFER
SamIFree_SAMPR_GET_GROUPS_BUFFER
SamIFree_SAMPR_GET_MEMBERS_BUFFER
SamIFree_SAMPR_GROUP_INFO_BUFFER
SamIFree_SAMPR_PSID_ARRAY
SamIFree_SAMPR_RETURNED_USTRING_ARRAY
SamIFree_SAMPR_SR_SECURITY_DESCRIPTOR
SamIFree_SAMPR_ULONG_ARRAY
SamIFree_SAMPR_USER_INFO_BUFFER
SamIFree_UserInternal6Information
SamIGCLookupNames
SamIGCLookupSids
SamIGetAliasMembership
SamIGetBootKeyInformation
SamIGetDefaultAdministratorName
SamIGetFixedAttributes
SamIGetInterdomainTrustAccountPasswordsForUpgrade
SamIGetPrivateData
SamIGetResourceGroupMembershipsTransitive
SamIGetSerialNumberDomain
SamIGetUserLogonInformation
SamIGetUserLogonInformation2
SamIGetUserLogonInformationEx
SamIImpersonateNullSession
SamIIncrementPerformanceCounter
SamIInitialize
SamIIsDownlevelDcUpgrade
SamIIsExtendedSidMode
SamIIsRebootAfterPromotion
SamIIsSetupInProgress
SamILoadDownlevelDatabase
SamILoopbackConnect
SamIMixedDomain
SamIMixedDomain2
SamINT4UpgradeInProgress
SamINetLogonPing
SamINotifyDelta
SamINotifyRoleChange
SamINotifyServerDelta
SamIOpenAccount
SamIOpenUserByAlternateId
SamIPromote
SamIPromoteUndo
SamIQueryServerRole
SamIQueryServerRole2
SamIRelaceDownlevelDatabase
SamIRemoveDSNameFromAlias
SamIRemoveDSNameFromGroup
SamIResetBadPwdCountOnPdc
SamIRetrievePrimaryCredentials
SamIRevertNullSession
SamISameSite
SamISetAuditingInformation
SamISetMixedDomainFlag
SamISetPasswordForeignUser
SamISetPasswordForeignUser2
SamISetPasswordInfoOnPdc
SamISetPrivateData
SamISetSerialNumberDomain
SamIStorePrimaryCredentials
SamIUPNFromUserHandle
SamIUnLoadDownlevelDatabase
SamIUpdateLogonStatistics
SampAbortSingleLoopbackTask
SampAccountControlToFlags
SampAcquireSamLockExclusive
SampAcquireWriteLock
SampCommitBufferedWrites
SampConvertNt4SdToNt5Sd
SampDsChangePasswordUser
SampFlagsToAccountControl
SampGetDefaultSecurityDescriptorForClass
SampGetSerialNumberDomain2
SampInitializeRegistry
SampInitializeSdConversion
SampInvalidateDomainCache
SampInvalidateRidRange
SampNetLogonNotificationRequired
SampNotifyReplicatedInChange
SampProcessSingleLoopbackTask
SampReleaseSamLockExclusive
SampReleaseWriteLock
SampRtlConvertUlongToUnicodeString
SampSetSerialNumberDomain2
SampUsingDsData
SampWriteGroupType
SamrAddMemberToAlias
SamrAddMemberToGroup
SamrAddMultipleMembersToAlias
SamrChangePasswordUser
SamrCloseHandle
SamrConnect
SamrCreateAliasInDomain
SamrCreateGroupInDomain
SamrCreateUser2InDomain
SamrCreateUserInDomain
SamrDeleteAlias
SamrDeleteGroup
SamrDeleteUser
SamrEnumerateAliasesInDomain
SamrEnumerateDomainsInSamServer
SamrEnumerateGroupsInDomain
SamrEnumerateUsersInDomain
SamrGetAliasMembership
SamrGetGroupsForUser
SamrGetMembersInAlias
SamrGetMembersInGroup
SamrGetUserDomainPasswordInformation
SamrLookupDomainInSamServer
SamrLookupIdsInDomain
SamrLookupNamesInDomain
SamrOpenAlias
SamrOpenDomain
SamrOpenGroup
SamrOpenUser
SamrQueryDisplayInformation
SamrQueryInformationAlias
SamrQueryInformationDomain
SamrQueryInformationGroup
SamrQueryInformationUser
SamrQuerySecurityObject
SamrRemoveMemberFromAlias
SamrRemoveMemberFromForeignDomain
SamrRemoveMemberFromGroup
SamrRemoveMultipleMembersFromAlias
SamrRidToSid
SamrSetInformationAlias
SamrSetInformationDomain
SamrSetInformationGroup
SamrSetInformationUser
SamrSetMemberAttributesOfGroup
SamrSetSecurityObject
SamrShutdownSamServer
SamrTestPrivateFunctionsDomain
SamrTestPrivateFunctionsUser
SamrUnicodeChangePasswordUser2

Sections

.text
Size: 131KB - Virtual size: 130KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 728B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rossym
Size: 162KB - Virtual size: 162KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d36ba8acd194f254f19505046b1f1c48

Headers

File Characteristics

Imports

ntdll

advapi32

kernel32

msvcrt

rpcrt4

Exports

Exports

Sections

.text Size: 131KB - Virtual size: 130KB

.data Size: 1024B - Virtual size: 728B

.rdata Size: 33KB - Virtual size: 32KB

.bss Size: - Virtual size: 5KB

.edata Size: 5KB - Virtual size: 5KB

.idata Size: 4KB - Virtual size: 3KB

.CRT Size: 512B - Virtual size: 44B

.tls Size: 512B - Virtual size: 8B

.rsrc Size: 40KB - Virtual size: 39KB

.reloc Size: 10KB - Virtual size: 10KB

.rossym Size: 162KB - Virtual size: 162KB

.text
Size: 131KB - Virtual size: 130KB

.data
Size: 1024B - Virtual size: 728B

.rdata
Size: 33KB - Virtual size: 32KB

.bss
Size: - Virtual size: 5KB

.edata
Size: 5KB - Virtual size: 5KB

.idata
Size: 4KB - Virtual size: 3KB

.CRT
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 8B

.rsrc
Size: 40KB - Virtual size: 39KB

.reloc
Size: 10KB - Virtual size: 10KB

.rossym
Size: 162KB - Virtual size: 162KB