04088e4722501e6f02c50e20cacc0dd5

Sharing

Copy URL Twitter E-mail

General

Target

04088e4722501e6f02c50e20cacc0dd5
Size

35KB
MD5

04088e4722501e6f02c50e20cacc0dd5
SHA1

13b685d0a942b81e91aa5d09b45a56704f29cf21
SHA256

2119753d561fb4777e2c4a5836eeccb1dcb0f7bfd4bc0736609c1a230ce9dbdc
SHA512

7a8908ebda9e1bd769e2e5934ded0fbd51658d72e0fd8b496d740924fe462c3128ddd7a01e37a4e8020ca2ca52a2ba0525c1531c63e855573f78d5e9aebceaef
SSDEEP

768:y9Z8KS0dASTl4mgW/V4//aj0MQ0LPq28fb:y9ZRhDTlnf63ajJ58

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
04088e4722501e6f02c50e20cacc0dd5

Files

04088e4722501e6f02c50e20cacc0dd5
.exe windows:4 windows x86 arch:x86

7ac5223268014c8a3c8a7cc0ec22ab01

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

dsprop

CrackName
BringSheetToForeground
IsSheetAlreadyUp
DSPROP_GetGCSearchOnDomain

crypt32

CertCompareCertificateName
CryptDecodeObject
CryptUnprotectData
CryptProtectData
CryptQueryObject
CertFreeCertificateContext
CertFindExtension
CertNameToStrW

ntdsapi

DsFreeDomainControllerInfoW
DsReplicaSyncW
DsReplicaConsistencyCheck
DsGetDomainControllerInfoW
DsBindW
DsRemoveDsServerW

advapi32

EqualSid
CryptReleaseContext
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegEnumKeyExW
RegCloseKey
BuildTrusteeWithSidW
AllocateAndInitializeSid
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
CryptAcquireContextW
GetSidSubAuthorityCount
SetEntriesInAclW
MakeSelfRelativeSD
GetLengthSid
RegQueryValueExW
RegOpenKeyExW
RegDeleteKeyW
GetSidSubAuthority
LsaFreeMemory
RegCreateKeyExW
RegSetValueExW
LsaClose
RegOpenKeyExA
LsaQueryInformationPolicy
GetSecurityDescriptorLength
IsValidSid
GetSidIdentifierAuthority
CopySid
CryptGenRandom
FreeSid
RegQueryValueExA
GetExplicitEntriesFromAclW
GetSecurityDescriptorControl
LsaNtStatusToWinError
BuildTrusteeWithObjectsAndSidW
LsaOpenPolicy
ConvertStringSDToSDDomainW

secur32

LsaFreeReturnBuffer
LsaCallAuthenticationPackage
LsaConnectUntrusted
LsaDeregisterLogonProcess
GetUserNameExW

ntdll

RtlFreeUnicodeString
RtlCreateUnicodeString
RtlCompareUnicodeString

adsldpc

ADsGetPreviousRow

shlwapi

PathAppendW

shell32

CommandLineToArgvW

ole32

StringFromCLSID
ReleaseStgMedium
CreateStreamOnHGlobal
CoUninitialize
CoTaskMemAlloc
CoCreateInstance
CoTaskMemRealloc
CoInitialize
StringFromGUID2
CLSIDFromString
CoCreateGuid
CoTaskMemFree

kernel32

SystemTimeToTzSpecificLocalTime
CompareStringW
InterlockedExchange
LoadResource
FindResourceW
lstrcpynW
GetProcAddress
LocalFree
GetLastError
GetTickCount
SetUnhandledExceptionFilter
lstrlenW
HeapFree
GlobalLock
LocalAlloc
GetComputerNameW
UnhandledExceptionFilter
GlobalAlloc
GetSystemTimeAsFileTime
GetWindowsDirectoryW
LockResource
GlobalSize
MultiByteToWideChar
SizeofResource
lstrcmpW
GetCurrentProcess
VirtualFree
DeleteCriticalSection
GlobalFree
lstrcpyW
QueryPerformanceCounter
GetModuleFileNameW
lstrlenA
EnterCriticalSection
GetCurrentProcessId
LoadLibraryA
SystemTimeToFileTime
LoadLibraryExW
VirtualAlloc
GetModuleHandleW
GetSystemDirectoryW
DnsHostnameToComputerNameW
IsBadWritePtr
LoadLibraryW
FlushInstructionCache
GetTimeFormatW
GetCommandLineW
LeaveCriticalSection
HeapAlloc
CompareFileTime
GlobalUnlock
GetProcessHeap
FormatMessageW
InterlockedIncrement
Sleep
GetDateFormatW
GetSystemWindowsDirectoryW
SetLastError
lstrcmpiW
InitializeCriticalSection
WaitForMultipleObjectsEx
InterlockedDecrement
FreeLibrary
TerminateProcess
GetCurrentThreadId

dnsapi

DnsValidateName_W

gdi32

GetTextMetricsW
GetTextExtentPoint32W
DeleteObject

user32

SetWindowTextW
GetSubMenu
SetWindowLongW
PtInRect
SetFocus
LoadBitmapW
GetParent
GetWindowTextLengthW
MessageBoxW
UpdateWindow
GetWindowTextW
CreateWindowExW
ChildWindowFromPointEx
DispatchMessageW
CallWindowProcW
LoadMenuW
LoadCursorW
PeekMessageW
ScreenToClient
DestroyWindow
LoadStringW
WinHelpW
MessageBoxIndirectW
SetDlgItemTextW
GetMenuItemCount
GetMenuItemInfoW
SetCursor
DrawIcon
BeginPaint
DestroyMenu
ShowWindow
GetActiveWindow
LoadIconW
DestroyIcon
GetClientRect
CreatePopupMenu
EnableWindow
wsprintfW
PostThreadMessageW
GetMessageW
CharToOemW
GetWindowRect
GetDlgCtrlID
PostMessageW
EndPaint
RegisterClipboardFormatW
IsWindow
GetWindowLongW
InsertMenuW
DefWindowProcW
GetDesktopWindow
GetSystemMetrics
GetDlgItem
SendMessageW

imm32

ImmAssociateContext

msvcrt

_vsnwprintf
__RTDynamicCast
__dllonexit
wcsstr
wcsncpy
_wtoi
malloc
wcscat
swscanf
wcschr
_wtol
wcscmp
_wcsnicmp
_adjust_fdiv
wcsncmp
_beginthreadex
_onexit
__RTtypeid
free
wcscpy
_wsetlocale
tolower
_initterm
memmove
_wcslwr
_wputenv
wcstol
wcstok
_purecall
_wcsdup
_wcsicmp
_wgetenv
_except_handler3
qsort
wcsncat
wcslen
__CxxFrameHandler
realloc

Sections

.text
Size: 512B - Virtual size: 396B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7ac5223268014c8a3c8a7cc0ec22ab01

Headers

File Characteristics

Imports

dsprop

crypt32

ntdsapi

advapi32

secur32

ntdll

adsldpc

shlwapi

shell32

ole32

kernel32

dnsapi

gdi32

user32

imm32

msvcrt

Sections

.text Size: 512B - Virtual size: 396B

.idata Size: 27KB - Virtual size: 27KB

.data Size: - Virtual size: 144KB

.rsrc Size: 5KB - Virtual size: 4KB

.rdata Size: 1KB - Virtual size: 1KB

.text
Size: 512B - Virtual size: 396B

.idata
Size: 27KB - Virtual size: 27KB

.data
Size: - Virtual size: 144KB

.rsrc
Size: 5KB - Virtual size: 4KB

.rdata
Size: 1KB - Virtual size: 1KB