0e27374de18f5ce45507558e288b534025189f4942dfa77500f17042214be8a0

Sharing

Copy URL Twitter E-mail

General

Target

0e27374de18f5ce45507558e288b534025189f4942dfa77500f17042214be8a0
Size

108KB
MD5

452cd311c5bd66fc73d062639f91726e
SHA1

c08e3e068f800c14d22415bc0ccb3cbf4f85f723
SHA256

0e27374de18f5ce45507558e288b534025189f4942dfa77500f17042214be8a0
SHA512

20b72d459c255411cea0fd8c4118f0942221be2d75588fe8577841b3d9959cda113ba3afe6d33270c3295cfcbebc432ec417d2340e777c22ece7c7427da9a7b6
SSDEEP

3072:oW18VbP5BKnZcyfmMlyKfIrwtAet0ketjqetzptonceaXnT:718VbP5UnZcXMsKfIroaXT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0e27374de18f5ce45507558e288b534025189f4942dfa77500f17042214be8a0

Files

0e27374de18f5ce45507558e288b534025189f4942dfa77500f17042214be8a0
.dll windows:4 windows x86 arch:x86

17c18c5c141475b5e9645b379b9debbb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

activeds

ord9

ole32

CoInitialize
CoUninitialize

oleaut32

SysAllocString
VariantClear
VariantInit
SysFreeString

wldap32

ord304
ord310
ord309
ord333
ord54
ord157
ord13
ord196
ord26
ord127
ord167
ord223
ord146
ord301
ord41
ord88
ord216
ord219
ord14
ord145
ord46
ord97
ord139
ord140
ord27
ord36
ord208
ord126

kernel32

CloseHandle
FlushFileBuffers
SetStdHandle
LoadLibraryA
IsBadCodePtr
IsBadReadPtr
SetFilePointer
GetOEMCP
GetStringTypeW
GetStringTypeA
GetSystemInfo
VirtualProtect
GetCPInfo
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
WriteFile
UnhandledExceptionFilter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetVersionExW
GetACP
GetLocaleInfoA
GetThreadLocale
GetLastError
WideCharToMultiByte
lstrlenW
RaiseException
InitializeCriticalSection
DeleteCriticalSection
InterlockedExchange
GetVersionExA
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
lstrlenA
LocalFree
VirtualQuery
HeapSize
GetCurrentProcess
TerminateProcess
SetUnhandledExceptionFilter
HeapFree
HeapAlloc
RtlUnwind
GetCurrentThreadId
GetCommandLineA
ExitProcess
HeapReAlloc
LCMapStringA
LCMapStringW
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
GetProcAddress
GetModuleHandleA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr

Exports

Exports

_Java_com_manageengine_idmf_fw_iamapps_server_passwordSync_onpremise_adlds_ADLDSHandler_changePassword@44
_Java_com_manageengine_idmf_fw_iamapps_server_passwordSync_onpremise_adlds_ADLDSHandler_domainAuthenticate@36
_Java_com_manageengine_idmf_fw_iamapps_server_passwordSync_onpremise_adlds_ADLDSHandler_getUserAccount@44
_Java_com_manageengine_idmf_fw_iamapps_server_passwordSync_onpremise_adlds_ADLDSHandler_resetPassword@44
_Java_com_manageengine_idmf_fw_iamapps_server_passwordSync_onpremise_adlds_ADLDSHandler_unlockUserAccount@40
_Java_com_manageengine_idmf_fw_iamapps_server_passwordSync_onpremise_adlds_ADLDSHandler_userAuthenticate@28
_Java_com_manageengine_idmf_fw_iamapps_server_passwordSync_onpremise_openldap_OpenLDAPHandler_changePassword@44
_Java_com_manageengine_idmf_fw_iamapps_server_passwordSync_onpremise_openldap_OpenLDAPHandler_domainAuthenticate@36
_Java_com_manageengine_idmf_fw_iamapps_server_passwordSync_onpremise_openldap_OpenLDAPHandler_getUserAccount@40
_Java_com_manageengine_idmf_fw_iamapps_server_passwordSync_onpremise_openldap_OpenLDAPHandler_resetPassword@44
_Java_com_manageengine_idmf_fw_iamapps_server_passwordSync_onpremise_openldap_OpenLDAPHandler_userAuthenticate@28

Sections

.text
Size: 72KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

17c18c5c141475b5e9645b379b9debbb

Headers

File Characteristics

Imports

activeds

ole32

oleaut32

wldap32

kernel32

Exports

Exports

Sections

.text Size: 72KB - Virtual size: 70KB

.rdata Size: 20KB - Virtual size: 17KB

.data Size: 4KB - Virtual size: 10KB

.reloc Size: 8KB - Virtual size: 5KB

.text
Size: 72KB - Virtual size: 70KB

.rdata
Size: 20KB - Virtual size: 17KB

.data
Size: 4KB - Virtual size: 10KB

.reloc
Size: 8KB - Virtual size: 5KB