2fe54cd120c0bf89a2d81e6a4281fff0

Sharing

Copy URL

Twitter E-mail

General

Target

2fe54cd120c0bf89a2d81e6a4281fff0
Size

258KB
MD5

2fe54cd120c0bf89a2d81e6a4281fff0
SHA1

c3e4feb9bd485087be4156aa40c0c1b95e4cb643
SHA256

e9b7423fa38eaa12e75c3b5e042229987a8c4869ec6f5a06e517eacfa111f898
SHA512

f9db655c8f789dc0094375cd6d908324af171fe59104110f56114f32f1efd8857f24b69958de67d2b1b1b4053ad125c858fd1d0f0604c531d2681c162b9df94d
SSDEEP

6144:9QBhbbszAYe3t05+vDt3ktm2EK1fmY0LJ:WBhkoPt3ktm81fmY0V

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2fe54cd120c0bf89a2d81e6a4281fff0

Files

2fe54cd120c0bf89a2d81e6a4281fff0
.dll windows:5 windows x86 arch:x86

ca16d32fc5a77af3609ab84ad3f8d141

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

activeds

ord7
ord21
ord22
ord23
ord17
ord18
ord15
ord14
ord16

advapi32

LockServiceDatabase
ChangeServiceConfigW
UnlockServiceDatabase
OpenServiceW
QueryServiceConfigW
OpenSCManagerW
CreateServiceW
CloseServiceHandle
QueryServiceStatus
GetSidSubAuthorityCount
GetSidSubAuthority
GetLengthSid
RegConnectRegistryW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
StartServiceW
ControlService
LookupAccountNameW
EnumServicesStatusW
DeleteService
GetUserNameW
SystemFunction040
SystemFunction041
GetSidIdentifierAuthority

kernel32

CompareStringW
GetTickCount
GetSystemTime
SystemTimeToFileTime
SetLastError
GetLastError
InterlockedIncrement
InterlockedDecrement
LocalFree
LocalAlloc
WaitForSingleObject
ReleaseSemaphore
LoadLibraryW
GetProcAddress
FreeLibrary
DeleteCriticalSection
CreateSemaphoreW
InitializeCriticalSection
DisableThreadLibraryCalls
GetComputerNameW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
LocalFileTimeToFileTime
FileTimeToLocalFileTime
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FormatMessageW
FileTimeToDosDateTime
DosDateTimeToFileTime
GetModuleHandleW
CloseHandle
EnterCriticalSection
LeaveCriticalSection
lstrlenW

mpr

WNetCancelConnection2W
WNetAddConnection2W

msvcrt

_CxxThrowException
free
_initterm
wcsrchr
wcscpy
_adjust_fdiv
__dllonexit
_onexit
_ftol
_wcsnicmp
wcschr
_ltow
_wtol
_itow
wcscmp
_except_handler3
wcslen
wcscat
_purecall
_wcsicmp
malloc

netapi32

NetLocalGroupGetMembers
NetGroupDel
NetLocalGroupDel
NetLocalGroupAdd
NetUserDel
I_NetNameCompare
NetFileEnum
NetGroupGetUsers
NetGetDCName
NetGetAnyDCName
DsRoleFreeMemory
DsRoleGetPrimaryDomainInformation
NetWkstaGetInfo
NetUseGetInfo
NetWkstaUserGetInfo
NetGroupEnum
NetFileGetInfo
NetLocalGroupEnum
NetShareEnum
NetShareDel
NetShareSetInfo
NetShareAdd
NetShareGetInfo
NetSessionDel
NetSessionEnum
NetSessionGetInfo
NetServerSetInfo
NetLocalGroupGetInfo
NetGroupAdd
NetGroupDelUser
NetGroupAddUser
NetLocalGroupAddMembers
NetLocalGroupDelMembers
NetUserGetLocalGroups
NetUserGetGroups
NetGroupGetInfo
NetUserChangePassword
NetUserAdd
NetServerGetInfo
NetLocalGroupSetInfo
NetGroupSetInfo
NetUserGetInfo
NetUserSetInfo
NetQueryDisplayInformation
NetUserModalsGet
NetUserModalsSet
NetApiBufferFree
NetServerEnum

ntdll

RtlRunEncodeUnicodeString
RtlInitUnicodeString
RtlRunDecodeUnicodeString
RtlSecondsSince1970ToTime
RtlTimeToSecondsSince1970

ole32

CoCreateInstance
CoTaskMemFree
StringFromCLSID
CreatePointerMoniker
StringFromGUID2
CLSIDFromString
IIDFromString

oleaut32

VariantInit
DispGetIDsOfNames
LoadRegTypeLi
DispInvoke
SetErrorInfo
VariantCopy
SysFreeString
SafeArrayDestroy
SafeArrayPutElement
SafeArrayCreate
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayGetLBound
SysAllocString
SafeArrayUnaccessData
SafeArrayAccessData
CreateErrorInfo
SystemTimeToVariantTime
VariantTimeToSystemTime
DosDateTimeToVariantTime
VariantTimeToDosDateTime
VariantClear

rassapi

ord3
ord2

user32

wsprintfW
LoadStringW

winspool.drv

DeletePrinter
GetJobW
EnumPrintersW
OpenPrinterW
SetPrinterW
ClosePrinter
AddPrinterW
GetPrinterW
EnumJobsW
SetJobW

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 221KB - Virtual size: 221KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ca16d32fc5a77af3609ab84ad3f8d141

Headers

File Characteristics

Imports

activeds

advapi32

kernel32

mpr

msvcrt

netapi32

ntdll

ole32

oleaut32

rassapi

user32

winspool.drv

Exports

Exports

Sections

.text Size: 221KB - Virtual size: 221KB

.data Size: 21KB - Virtual size: 21KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 12KB - Virtual size: 11KB

.text
Size: 221KB - Virtual size: 221KB

.data
Size: 21KB - Virtual size: 21KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 12KB - Virtual size: 11KB