ad9b1df7b522dd52ac771769e5861a3e728f08a879ae12a8a5d0013ed1bd48b2

Sharing

Copy URL

Twitter E-mail

General

Target

ad9b1df7b522dd52ac771769e5861a3e728f08a879ae12a8a5d0013ed1bd48b2
Size

108KB
MD5

9e9b8d3ec6956be9fd28ca8188dbf632
SHA1

62b7ae6d76d48ea3837bc1633b72af00200371fe
SHA256

ad9b1df7b522dd52ac771769e5861a3e728f08a879ae12a8a5d0013ed1bd48b2
SHA512

8581f41da8dbacd07f642fc8dbfa7aab4e29c43793da2c92c15ba5bcc968602cf5e254ed415a1b399c172c13338e1f9d111cf3aa7a7a2483d3e3c5e9bdc2dfb4
SSDEEP

1536:HDj12id0hKy+k1DQ+7Gpj3r4M7TGfwG1K9IJvydlnk4pCxvnr:HDG1DQgGpj3Cf1K9IBydlk+cvnr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ad9b1df7b522dd52ac771769e5861a3e728f08a879ae12a8a5d0013ed1bd48b2

Files

ad9b1df7b522dd52ac771769e5861a3e728f08a879ae12a8a5d0013ed1bd48b2
.exe windows:5 windows x86

34b5ff520f647e2d2efcbbe4028c21f4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_AGGRESIVE_WS_TRIM
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

AllocateLocallyUniqueId
RegOpenKeyW
ConvertSidToStringSidW
AllocateAndInitializeSid
FreeSid
LogonUserExW
LsaStorePrivateData
LsaLookupNames
AddAccessAllowedAce
SetTokenInformation
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
SetServiceStatus
SystemFunction029
SystemFunction005
CheckTokenMembership
LsaQueryInformationPolicy
OpenThreadToken
RegNotifyChangeKeyValue
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
GetSecurityDescriptorDacl
GetLengthSid
CopySid
InitializeAcl
AddAce
SetSecurityDescriptorDacl
LsaOpenPolicy
LsaLookupSids
LsaFreeMemory
LsaClose
GetTokenInformation
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
InitiateSystemShutdownW
RevertToSelf
CreateProcessAsUserW
ImpersonateLoggedOnUser

kernel32

GetCurrentThread
CreateMutexW
ReleaseMutex
ExitThread
FormatMessageW
lstrcmpiW
SetProcessShutdownParameters
DelayLoadFailureHook
RaiseException
GetExitCodeThread
SetConsoleCtrlHandler
SetErrorMode
SetUnhandledExceptionFilter
LoadLibraryA
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcess
UnhandledExceptionFilter
GetModuleHandleA
OpenEventW
LocalAlloc
LocalFree
Sleep
LeaveCriticalSection
EnterCriticalSection
SetLastError
CloseHandle
CreateThread
GetLastError
CreateProcessW
ExpandEnvironmentStringsW
InitializeCriticalSection
HeapAlloc
HeapFree
TerminateProcess
WaitForSingleObject
HeapCreate
FreeLibrary
GetProcAddress
GetModuleHandleExW
InterlockedCompareExchange
CreateNamedPipeW
ReadFile
CancelIo
GetOverlappedResult
WaitForMultipleObjects
ConnectNamedPipe
TransactNamedPipe
WriteFile
GetTickCount
GetSystemTimeAsFileTime
GetModuleHandleW
GetComputerNameW
CreateEventW
SetEvent
ResetEvent
DeviceIoControl
CreateFileW
ResumeThread
GetCurrentProcessId
LoadLibraryW
GetDriveTypeW

msvcrt

_itow
wcsrchr
time
_except_handler3
memmove
wcschr
_c_exit
_exit
wcsncmp
_XcptFilter
_cexit
exit
_wcsnicmp
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_wtol
wcscpy
wcscat
wcsncpy
_wcsicmp
__initenv
wcslen
wcscspn
_ultow

ncobjapi

WmiCreateObjectWithFormat
WmiEventSourceConnect
WmiSetAndCommitObject

ntdll

RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
NtCreateKey
NtQueryValueKey
NtSetValueKey
NtDeleteValueKey
NtEnumerateKey
NtQuerySecurityObject
RtlFreeHeap
NtOpenKey
NtDeleteKey
RtlSetControlSecurityDescriptor
RtlValidSecurityDescriptor
RtlLengthSecurityDescriptor
NtPrivilegeObjectAuditAlarm
NtPrivilegeCheck
NtOpenThreadToken
NtAccessCheckAndAuditAlarm
NtSetInformationThread
NtAdjustPrivilegesToken
NtDuplicateToken
NtOpenProcessToken
RtlSetDaclSecurityDescriptor
RtlQuerySecurityObject
RtlSetSecurityObject
RtlValidRelativeSecurityDescriptor
RtlMapGenericMask
RtlCopyUnicodeString
NtSetInformationFile
NtQueryInformationFile
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
NtWaitForSingleObject
NtQueryDirectoryFile
NtDeleteFile
NtSetInformationProcess
RtlUnhandledExceptionFilter
NtSetEvent
RtlGetAce
RtlQueryInformationAcl
RtlGetDaclSecurityDescriptor
RtlAllocateHeap
RtlConvertSharedToExclusive
RtlConvertExclusiveToShared
RtlRegisterWait
RtlGetNtProductType
RtlEqualUnicodeString
RtlLengthSid
RtlCopySid
NtOpenDirectoryObject
NtQueryDirectoryObject
RtlUnicodeStringToAnsiString
RtlInitAnsiString
RtlAnsiStringToUnicodeString
RtlNewSecurityObject
RtlAddAce
RtlSetOwnerSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlSetSaclSecurityDescriptor
RtlSubAuthorityCountSid
RtlCompareUnicodeString
NtLoadDriver
NtUnloadDriver
RtlExpandEnvironmentStrings_U
RtlAdjustPrivilege
NtFlushKey
NtOpenFile
RtlDosPathNameToNtPathName_U
NtOpenSymbolicLinkObject
NtQuerySymbolicLinkObject
RtlFreeUnicodeString
RtlAreAllAccessesGranted
NtDeleteObjectAuditAlarm
NtCloseObjectAuditAlarm
RtlQueueWorkItem
RtlCopyLuid
RtlDeregisterWait
RtlReleaseResource
RtlAcquireResourceExclusive
RtlAcquireResourceShared
RtlInitializeResource
RtlDeleteSecurityObject
RtlLockBootStatusData
RtlGetSetBootStatusData
RtlUnlockBootStatusData
NtInitializeRegistry
NtQueryKey
NtClose
RtlInitUnicodeString
NtSetSystemEnvironmentValue
RtlNtStatusToDosError
NtShutdownSystem
NtQueryInformationToken
RtlMakeSelfRelativeSD
RtlInitializeSid
RtlLengthRequiredSid
RtlSubAuthoritySid
NtSetSecurityObject

rpcrt4

RpcServerRegisterAuthInfoW
RpcBindingFree
RpcEpResolveBinding
RpcBindingFromStringBindingW
RpcStringBindingComposeW
NdrClientCall2
RpcAsyncCompleteCall
RpcAsyncInitializeHandle
NdrAsyncServerCall
RpcServerListen
RpcMgmtStopServerListening
RpcMgmtWaitServerListen
RpcServerUnregisterIf
NdrAsyncClientCall
NdrServerCall2
I_RpcBindingIsClientLocal
RpcRevertToSelf
I_RpcMapWin32Status
RpcImpersonateClient
RpcStringBindingParseW
RpcStringFreeW
RpcBindingToStringBindingW
RpcServerRegisterIfEx
RpcServerUseProtseqEpW
RpcServerRegisterIf

scesrv

ScesrvInitializeServer
ScesrvTerminateServer

umpnpmgr

RegisterScmCallback
PNP_SetActiveService
PNP_GetDeviceRegProp
PNP_GetDeviceListSize
PNP_GetDeviceList
PNP_HwProfFlags
RegisterServiceNotification
DeleteServicePlugPlayRegKeys

user32

LoadStringW
wsprintfW
BroadcastSystemMessageW
MessageBoxW
RegisterServicesProcess

userenv

UnloadUserProfile
CreateEnvironmentBlock
LoadUserProfileW
DestroyEnvironmentBlock

Sections

.text
Size: 102KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

34b5ff520f647e2d2efcbbe4028c21f4

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

ncobjapi

ntdll

rpcrt4

scesrv

umpnpmgr

user32

userenv

Sections

.text Size: 102KB - Virtual size: 101KB

.data Size: 3KB - Virtual size: 2KB

.rsrc Size: 2KB - Virtual size: 2KB

.text
Size: 102KB - Virtual size: 101KB

.data
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 2KB - Virtual size: 2KB