17d65cb5987e767f3b7e80c6c090cdf3

Sharing

Copy URL Twitter E-mail

General

Target

17d65cb5987e767f3b7e80c6c090cdf3
Size

179KB
MD5

17d65cb5987e767f3b7e80c6c090cdf3
SHA1

435cbfcda263380a3c09897fd4c5b1fdace460f0
SHA256

e0c4a3e21cc223d4dce7a209c61b1e9f135424bdf7d1cabedb03918ccc9836e0
SHA512

434794308f7c0b7d5436baa98ff8f7e4b81266c7a507ac513ddf35bdabf246103ff1e4f6f12a841927e36b5e43f0d8867d111be0c8b534ba120332a8f6a70d55
SSDEEP

3072:2VXv/1HZdwBxpayXaO6WuidyCxNcndnf9U/yij62g1Nn:q/1HLwBxp7aO6Wu+EV9Kr62

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
17d65cb5987e767f3b7e80c6c090cdf3

Files

17d65cb5987e767f3b7e80c6c090cdf3
.dll regsvr32 windows:5 windows x86 arch:x86

72f93c8267e992058418aa9198546671

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

RegOpenKeyExW
RegisterServiceCtrlHandlerExW
SetServiceStatus
OpenThreadToken
PrivilegeCheck
GetTokenInformation
LookupAccountSidW
ConvertSidToStringSidW
I_ScSetServiceBitsW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegEnumKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
LsaNtStatusToWinError
RegDeleteKeyW
DeleteService
OpenSCManagerW
CreateServiceW
OpenServiceW
ChangeServiceConfig2W
ChangeServiceConfigW
CloseServiceHandle
RegCreateKeyExW
RegSetValueExW
RegDeleteValueW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
RegQueryValueExW
RegCloseKey

iphlpapi

NotifyAddrChange
GetIpAddrTable

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
EnterCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
LocalFree
DeleteCriticalSection
LocalAlloc
GetLastError
CreateTimerQueueTimer
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CloseHandle
CreateEventW
WaitForSingleObject
WriteFile
GetCurrentThreadId
InterlockedIncrement
GetFileSizeEx
CreateFileW
InterlockedDecrement
GetSystemTimeAdjustment
GetModuleFileNameW
GetModuleHandleW
FormatMessageW
UnregisterWait
RegisterWaitForSingleObject
SetHandleInformation
UnregisterWaitEx
SetEvent
GetTickCount
QueueUserWorkItem
OpenEventW
SetTimeZoneInformation
GetTimeZoneInformation
GetCurrentProcess
WaitForMultipleObjects
FreeLibrary
SetSystemTimeAdjustment
SetSystemTime
GetSystemTime
SetThreadPriority
GetCurrentThread
CreateThread
ResetEvent
GetExitCodeThread
GetProcAddress
LoadLibraryW
QueryPerformanceFrequency
DisableThreadLibraryCalls
QueryPerformanceCounter

msvcp60

??1bad_alloc@std@@UAE@XZ

msvcrt

wcscmp
??3@YAXPAX@Z
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_except_handler3
ceil
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
_CxxThrowException
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
?what@exception@@UBEPBDXZ
memmove
_ultow
qsort
_wcsnicmp
??1exception@@UAE@XZ
wcscat
_wcsicmp
__CxxFrameHandler
_ftol
wcsstr
??2@YAPAXI@Z
_vsnwprintf
swprintf
wcschr
wcsncpy
wcscspn
wcscpy
wcslen
wcstoul

netapi32

DsGetSiteNameW
NetLogonGetTimeServiceParentDomain
NetLogonSetServiceBits
I_NetlogonComputeClientDigest
DsGetDcNameW
NetApiBufferFree
I_NetlogonGetTrustRid
DsRoleGetPrimaryDomainInformation
DsRoleFreeMemory
I_NetlogonComputeServerDigest

ntdll

NtSetSystemTime
NtQuerySystemTime
NtSetSystemInformation

rpcrt4

RpcMgmtWaitServerListen
RpcMgmtStopServerListening
RpcServerUnregisterIf
RpcRevertToSelf
RpcImpersonateClient
RpcBindingSetAuthInfoW
RpcMgmtInqServerPrincNameW
RpcBindingFree
RpcBindingFromStringBindingW
RpcStringBindingComposeW
NdrClientCall2
NdrServerCall2
RpcStringFreeW
RpcServerRegisterAuthInfoW
RpcServerListen
RpcServerUseProtseqEpW
RpcServerInqDefaultPrincNameW
RpcServerRegisterIf

secur32

LsaUnregisterPolicyChangeNotification
LsaRegisterPolicyChangeNotification

user32

wsprintfW

userenv

RegisterGPNotification
UnregisterGPNotification

ws2_32

WSAGetLastError
WSAEventSelect
bind
socket
htons
closesocket
WSAStartup
WSAAddressToStringW
sendto
recvfrom
WSACleanup
WSALookupServiceEnd
WSALookupServiceNextW
WSALookupServiceBeginW

Exports

Exports

DllInstall
DllRegisterServer
DllUnregisterServer
SvchostEntry_W32Time
SvchostPushServiceGlobals
TimeProvClose
TimeProvCommand
TimeProvOpen
W32TimeBufferFree
W32TimeDcPromo
W32TimeGetNetlogonServiceBits
W32TimeQueryConfig
W32TimeQueryHardwareProviderStatus
W32TimeQueryNTPProviderStatus
W32TimeSetConfig
W32TimeSyncNow
W32TimeVerifyJoinConfig
W32TimeVerifyUnjoinConfig
W32TmServiceMain
fnW32TmRegisterServiceCtrlHandlerEx
fnW32TmSetServiceStatus

Sections

.text
Size: 140KB - Virtual size: 139KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

72f93c8267e992058418aa9198546671

Headers

File Characteristics

Imports

advapi32

iphlpapi

kernel32

msvcp60

msvcrt

netapi32

ntdll

rpcrt4

secur32

user32

userenv

ws2_32

Exports

Exports

Sections

.text Size: 140KB - Virtual size: 139KB

.data Size: 3KB - Virtual size: 2KB

.rsrc Size: 27KB - Virtual size: 27KB

.reloc Size: 7KB - Virtual size: 7KB

.text
Size: 140KB - Virtual size: 139KB

.data
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 27KB - Virtual size: 27KB

.reloc
Size: 7KB - Virtual size: 7KB