fad6cc8602f383e328632467ae71c0fc

General

Target

fad6cc8602f383e328632467ae71c0fc
Size

1.1MB
MD5

fad6cc8602f383e328632467ae71c0fc
SHA1

d8635d38d870b0a0c0e7e23e8f8da88be08b9bf3
SHA256

d47f7ee47eb7b144a49995ff0b5a4890cc729a0642087ab81920978821133b6c
SHA512

a752e79f1c6d76a4534f706b39e31d9aee8e21201738ac99cc2634fcd9d3650c9195b0f4221dbda784b7824066bd56b2c5e4504bbfce320d6c0487f3a228ccd8
SSDEEP

24576:QvLZQ+tqbyGlB8Tt+IOC5V5m4+K3EKi9m+kc1OqEa:Qv1QryGzMZPD1ugtc1ca

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fad6cc8602f383e328632467ae71c0fc

Files

fad6cc8602f383e328632467ae71c0fc
.exe windows:0 windows x86 arch:x86

569a980c0afbb545423a3349266fe664

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advpack

TranslateInfString
DelNodeRunDLL32
AdvInstallFile
CloseINFEngine

odbc32

SQLPrimaryKeysA
SQLNumResultCols
SQLGetConnectOptionA
SQLExecute
SQLAllocEnv
SQLFetchScroll
SQLColAttribute
SQLFetch
DllBidEntryPoint
SQLCopyDesc
SQLStatistics
SQLGetStmtAttrA
SQLSpecialColumns
SQLEndTran
CursorLibLockDesc
SQLAllocStmt
SQLSetScrollOptions
SQLPrepareA
SQLCancel
SQLGetTypeInfo

kernel32

DeleteFileA
SystemTimeToFileTime
lstrcmpiA
DosDateTimeToFileTime
FileTimeToLocalFileTime
GetFileTime
ExitProcess
InterlockedCompareExchange
EnterCriticalSection
GetSystemTimeAdjustment
FileTimeToDosDateTime
GetNamedPipeInfo
CreateNamedPipeA
WriteFileEx
CreateFileA
LeaveCriticalSection
lstrcpyA
GetCurrentProcessId
SetFilePointer
GetSystemTimeAsFileTime
ConnectNamedPipe
ReadFile
InterlockedFlushSList
WaitNamedPipeA
CallNamedPipeA
PeekNamedPipe
GetSystemTime
InitializeCriticalSectionAndSpinCount
InterlockedIncrement
VirtualAlloc
InterlockedDecrement
CloseHandle
WaitForMultipleObjects
GetCurrentThreadId
VirtualFree

adsldpc

BuildADsPathFromLDAPPath2
AdsTypeToLdapTypeCopyTime
GetDomainDNSNameForDomain
ADSIGetColumn
BuildADsParentPathFromObjectInfo2
ADsDecodeBinaryData
InitObjectInfo
ADSIAbandonSearch
ADsObject
ADSIDeleteDSObject
ADSIExecuteSearch
ADSIOpenDSObject
IsGCNamespace
ADsWriteClassDefinition
ADsCloseSearchHandle
ConvertSidToString

Sections

.text
Size: 667KB - Virtual size: 667KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 146KB - Virtual size: 146KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 301KB - Virtual size: 3.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

569a980c0afbb545423a3349266fe664

Headers

DLL Characteristics

File Characteristics

Imports

advpack

odbc32

kernel32

adsldpc

Sections

.text Size: 667KB - Virtual size: 667KB

.data Size: 146KB - Virtual size: 146KB

.rsrc Size: 301KB - Virtual size: 3.4MB

.text
Size: 667KB - Virtual size: 667KB

.data
Size: 146KB - Virtual size: 146KB

.rsrc
Size: 301KB - Virtual size: 3.4MB