c9a8691d127de3b35d3be923ef3e79b1f7a8bda38c221dae59fd723f3dd73af9

Sharing

Copy URL

Twitter E-mail

General

Target

c9a8691d127de3b35d3be923ef3e79b1f7a8bda38c221dae59fd723f3dd73af9
Size

272KB
MD5

8003cf572c9c8bd9c1e367df5b71cccf
SHA1

8d5275365081f838bd7aef8b4f1afd99daa258b7
SHA256

c9a8691d127de3b35d3be923ef3e79b1f7a8bda38c221dae59fd723f3dd73af9
SHA512

bcc9c940c687ac6aa6e355d79d017158d86924c8125a76a8a2051f55648780230a6848b07c8dd3d49fb8f92471d18534e1e8710c3a25b00a6e6dd1418af41f93
SSDEEP

3072:XdwvMtHAuDCfCweKY2tWwcV5gjXouCLZfFLnHMx4KxgvhVrlYNGW+ZsuAo8G76vy:twvMiVf0s+gjXwnkLqLrGLNywMR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c9a8691d127de3b35d3be923ef3e79b1f7a8bda38c221dae59fd723f3dd73af9

Files

c9a8691d127de3b35d3be923ef3e79b1f7a8bda38c221dae59fd723f3dd73af9
.dll windows:6 windows x64

9cd3ebe5bf7f19d4b114223e61dc841b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

samsrv

SamIFree_SAMPR_ULONG_ARRAY
SamrLookupNamesInDomain
SamrLookupIdsInDomain
SamrConnect
SamIFree_SAMPR_RETURNED_USTRING_ARRAY
SamrGetAliasMembership
SamrOpenDomain
SamrCloseHandle
SamIConnect

rpcrt4

NdrServerCall2
I_RpcMapWin32Status
RpcRevertToSelf
RpcImpersonateClient
RpcServerUseProtseqEpW
RpcServerListen
RpcServerRegisterIf

msvcrt

memcpy
_initterm
_amsg_exit
free
sprintf
bsearch
strcspn
strchr
strlen
strcmp
strcpy
memcmp
_wcsicmp
memmove
wcslen
wcschr
wcscpy
__C_specific_handler
memset
_strnicmp

kernel32

TlsGetValue
LeaveCriticalSection
InitializeCriticalSection
EnterCriticalSection
DeleteCriticalSection
DisableThreadLibraryCalls
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
Sleep
SetLastError
LocalReAlloc
LocalAlloc
GetEnvironmentVariableA
RtlRaiseException
LockResource
LoadResource
FindResourceW
WaitForSingleObject
OpenEventW
LoadLibraryW
GetProcAddress
FreeLibrary
CloseHandle
SetEvent
GetLastError
CreateEventW
GetModuleHandleW
LocalFree
CreateThread

advapi32

I_ScIsSecurityProcess
ConvertSidToStringSidW
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerW
GetLengthSid
LsaNtStatusToWinError
EqualSid

ntdll

ZwEnumerateKey
ZwQueryValueKey
RtlAbsoluteToSelfRelativeSD
RtlAddAccessDeniedAce
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlValidateUnicodeString
NtConnectPort
NtListenPort
NtRequestWaitReplyPort
DbgPrint
vDbgPrintExWithPrefix
NtAllocateVirtualMemory
NtFreeVirtualMemory
NtReadVirtualMemory
NtWriteVirtualMemory
NtClose
NtDuplicateObject
RtlAllocateHeap
RtlFreeHeap
RtlAddAccessAllowedAce
RtlCreateAcl
RtlEqualSid
RtlLengthRequiredSid
RtlLengthSid
RtlInitAnsiString
RtlQueryRegistryValues
NtCreateToken
LdrGetProcedureAddress
LdrLoadDll
LdrUnloadDll
NtCreateEvent
NtOpenEvent
NtSetEvent
NtOpenProcess
NtOpenProcessToken
RtlInitUnicodeString
NtQueryInformationToken
NtAcceptConnectPort
NtCompleteConnectPort
NtCreatePort
NtReplyPort
NtReplyWaitReceivePort
NtCreateKey
NtOpenKey
NtQuerySystemTime
RtlAllocateAndInitializeSid
RtlFreeSid
RtlpNtOpenKey
RtlpNtQueryValueKey
RtlpNtSetValueKey
RtlUniform
RtlCopySid
RtlIdentifierAuthoritySid
RtlInitializeSid
RtlSubAuthorityCountSid
RtlSubAuthoritySid
RtlEqualUnicodeString
NtOpenThreadToken
RtlCopyLuid
RtlCopyLuidAndAttributesArray
RtlLengthSecurityDescriptor
RtlMakeSelfRelativeSD
RtlValidSecurityDescriptor
RtlValidSid
RtlSetSecurityObject
RtlEnterCriticalSection
RtlInitializeCriticalSection
RtlLeaveCriticalSection
RtlAdjustPrivilege
RtlGetNtProductType
RtlAcquireResourceExclusive
RtlAcquireResourceShared
RtlInitializeResource
RtlReleaseResource
NtDeleteKey
NtQueryKey

Exports

Exports

DsRolerDcAsDc
DsRolerDcAsReplica
DsRolerDemoteDc
DsRolerGetDcOperationProgress
DsRolerGetDcOperationResults
LsaIAddNameToLogonSession
LsaIAllocateHeap
LsaIAllocateHeapZero
LsaIAuditAccountLogon
LsaIAuditAccountLogonEx
LsaIAuditKdcEvent
LsaIAuditKerberosLogon
LsaIAuditLogonUsingExplicitCreds
LsaIAuditNotifyPackageLoad
LsaIAuditPasswordAccessEvent
LsaIAuditSamEvent
LsaICallPackage
LsaICallPackageEx
LsaICallPackagePassthrough
LsaICancelNotification
LsaIChangeSecretCipherKey
LsaICryptProtectData
LsaICryptUnprotectData
LsaIDsNotifiedObjectChange
LsaIEnumerateSecrets
LsaIEventNotify
LsaIFilterSids
LsaIForestTrustFindMatch
LsaIFreeForestTrustInfo
LsaIFreeHeap
LsaIFreeReturnBuffer
LsaIFree_LSAI_PRIVATE_DATA
LsaIFree_LSAI_SECRET_ENUM_BUFFER
LsaIFree_LSAPR_ACCOUNT_ENUM_BUFFER
LsaIFree_LSAPR_CR_CIPHER_VALUE
LsaIFree_LSAPR_POLICY_DOMAIN_INFORMATION
LsaIFree_LSAPR_POLICY_INFORMATION
LsaIFree_LSAPR_PRIVILEGE_ENUM_BUFFER
LsaIFree_LSAPR_PRIVILEGE_SET
LsaIFree_LSAPR_REFERENCED_DOMAIN_LIST
LsaIFree_LSAPR_SR_SECURITY_DESCRIPTOR
LsaIFree_LSAPR_TRANSLATED_NAMES
LsaIFree_LSAPR_TRANSLATED_SIDS
LsaIFree_LSAPR_TRUSTED_DOMAIN_INFO
LsaIFree_LSAPR_TRUSTED_ENUM_BUFFER
LsaIFree_LSAPR_TRUSTED_ENUM_BUFFER_EX
LsaIFree_LSAPR_TRUST_INFORMATION
LsaIFree_LSAPR_UNICODE_STRING
LsaIFree_LSAPR_UNICODE_STRING_BUFFER
LsaIFree_LSAP_SITENAME_INFO
LsaIFree_LSAP_SITE_INFO
LsaIFree_LSAP_SUBNET_INFO
LsaIFree_LSAP_UPN_SUFFIXES
LsaIFree_LSA_FOREST_TRUST_COLLISION_INFORMATION
LsaIFree_LSA_FOREST_TRUST_INFORMATION
LsaIGetBootOption
LsaIGetCallInfo
LsaIGetForestTrustInformation
LsaIGetLogonGuid
LsaIGetNbAndDnsDomainNames
LsaIGetPrivateData
LsaIGetSerialNumberPolicy
LsaIGetSerialNumberPolicy2
LsaIGetSiteName
LsaIHealthCheck
LsaIImpersonateClient
LsaIInitializeWellKnownSids
LsaIIsClassIdLsaClass
LsaIIsDsPaused
LsaIKerberosRegisterTrustNotification
LsaILookupWellKnownName
LsaINotifyChangeNotification
LsaINotifyNetlogonParametersChangeW
LsaINotifyPasswordChanged
LsaIOpenPolicyTrusted
LsaIQueryForestTrustInfo
LsaIQueryInformationPolicyTrusted
LsaIQuerySiteInfo
LsaIQuerySubnetInfo
LsaIQueryUpnSuffixes
LsaIRegisterNotification
LsaIRegisterPolicyChangeNotificationCallback
LsaISafeMode
LsaISamIndicatedDsStarted
LsaISetBootOption
LsaISetClientDnsHostName
LsaISetLogonGuidInLogonSession
LsaISetPrivateData
LsaISetSerialNumberPolicy
LsaISetTimesSecret
LsaISetupWasRun
LsaITestCall
LsaIUnregisterAllPolicyChangeNotificationCallback
LsaIUnregisterPolicyChangeNotificationCallback
LsaIUpdateForestTrustInformation
LsaIWriteAuditEvent
LsapAuOpenSam
LsapCheckBootMode
LsapDsDebugInitialize
LsapDsInitializeDsStateInfo
LsapDsInitializePromoteInterface
LsapInitLsa
LsarAddPrivilegesToAccount
LsarClose
LsarCreateAccount
LsarCreateSecret
LsarCreateTrustedDomain
LsarCreateTrustedDomainEx
LsarDelete
LsarEnumerateAccounts
LsarEnumeratePrivileges
LsarEnumeratePrivilegesAccount
LsarEnumerateTrustedDomains
LsarEnumerateTrustedDomainsEx
LsarGetQuotasForAccount
LsarGetSystemAccessAccount
LsarLookupNames
LsarLookupPrivilegeDisplayName
LsarLookupPrivilegeName
LsarLookupPrivilegeValue
LsarLookupSids
LsarLookupSids2
LsarOpenAccount
LsarOpenPolicy
LsarOpenPolicySce
LsarOpenSecret
LsarOpenTrustedDomain
LsarOpenTrustedDomainByName
LsarQueryDomainInformationPolicy
LsarQueryForestTrustInformation
LsarQueryInfoTrustedDomain
LsarQueryInformationPolicy
LsarQuerySecret
LsarQuerySecurityObject
LsarQueryTrustedDomainInfo
LsarQueryTrustedDomainInfoByName
LsarRemovePrivilegesFromAccount
LsarSetDomainInformationPolicy
LsarSetForestTrustInformation
LsarSetInformationPolicy
LsarSetInformationTrustedDomain
LsarSetQuotasForAccount
LsarSetSecret
LsarSetSecurityObject
LsarSetSystemAccessAccount
LsarSetTrustedDomainInfoByName
ServiceInit

Sections

.text
Size: 176KB - Virtual size: 176KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 624B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9cd3ebe5bf7f19d4b114223e61dc841b

Headers

DLL Characteristics

File Characteristics

Imports

samsrv

rpcrt4

msvcrt

kernel32

advapi32

ntdll

Exports

Exports

Sections

.text Size: 176KB - Virtual size: 176KB

.rdata Size: 50KB - Virtual size: 49KB

.data Size: 1KB - Virtual size: 6KB

.pdata Size: 4KB - Virtual size: 4KB

.rsrc Size: 38KB - Virtual size: 37KB

.reloc Size: 1024B - Virtual size: 624B

.text
Size: 176KB - Virtual size: 176KB

.rdata
Size: 50KB - Virtual size: 49KB

.data
Size: 1KB - Virtual size: 6KB

.pdata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 38KB - Virtual size: 37KB

.reloc
Size: 1024B - Virtual size: 624B