1dfc38d2fd46f826fb7aae23349f4e76

Sharing

Copy URL

Twitter E-mail

General

Target

1dfc38d2fd46f826fb7aae23349f4e76
Size

862KB
MD5

1dfc38d2fd46f826fb7aae23349f4e76
SHA1

fd9d0ff5f248b706315a2ffb47aa329a220444a5
SHA256

7220e8cf65612a4366b7316d3956a55b7ae9d6e59882467f863687b9da68d5e3
SHA512

f4ddc8305490019a71b0eac71d5b3011c0bd7489c4a836831ddd8cfd96359a58d18ea3213bf9d79fd3348283c619a20d6a4489f115d135a6b55b8eb760b53ddc
SSDEEP

12288:xkSbVBFYimXoZRplYFl2Om02f/Oi4oRZ5CLxLBL9lnvsiuiDBcRSR/Lg5bpmaN1c:xAHXo9V3O9IovDvs89cRQMppm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1dfc38d2fd46f826fb7aae23349f4e76

Files

1dfc38d2fd46f826fb7aae23349f4e76
.exe windows:5 windows x86 arch:x86

fbecdffad228eb402cf2bd16aaf3bc6d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

LdrQueryImageFileExecutionOptions
RtlUnicodeToCustomCPN
ZwAddAtom
strtol
LdrFindEntryForAddress
sscanf
RtlTraceDatabaseLock
isdigit
NtCompressKey
NtQueryBootOptions
RtlGUIDFromString
RtlSubAuthoritySid
RtlCopyString
NtQueryIoCompletion
ZwAccessCheckByTypeResultListAndAuditAlarmByHandle
RtlAddRefActivationContext
ZwCreateFile
ZwQueryTimerResolution
ZwCreateIoCompletion
NtSetEventBoostPriority
RtlComputeImportTableHash
RtlUnicodeStringToAnsiString
NtQueryPerformanceCounter
RtlSetBits
NtQueryDefaultUILanguage
RtlDumpResource
ZwIsProcessInJob
RtlLogStackBackTrace
RtlUnlockHeap
RtlFindClearRuns
RtlIpv6StringToAddressW
RtlGetNtGlobalFlags
ZwCreateSymbolicLinkObject
ZwEnumerateValueKey
ZwExtendSection

gdi32

EngAcquireSemaphore
FONTOBJ_pxoGetXform
SetLayout
GdiAddFontResourceW
GetTextMetricsA
AddFontResourceExA
EngMarkBandingSurface
EngGetCurrentCodePage
PolyBezierTo
GetBkMode
OffsetViewportOrgEx
EngCreateDeviceBitmap
SelectClipPath
CLIPOBJ_cEnumStart
GetColorAdjustment
GdiCreateLocalMetaFilePict
EnumMetaFile
GdiConvertPalette
EngGradientFill
ExtTextOutA
PATHOBJ_bEnum
GetNearestPaletteIndex
bInitSystemAndFontsDirectoriesW
SetSystemPaletteUse
SetPaletteEntries
GdiGetSpoolFileHandle
DdEntry54
GetCharWidthI
CreateRoundRectRgn
SetICMMode
PATHOBJ_bEnumClipLines
DdEntry56
GetMetaFileA
DdEntry55
PolyPolygon
DdEntry22
GdiGetDC
GetStringBitmapA
GetDCOrgEx
SetMagicColors
ArcTo
SetROP2
GetETM

adsldpc

AdsTypeToLdapTypeCopyDNWithBinary
LdapMemFree
ADsGetPreviousRow
LdapControlFree
FreeADsStr
LdapDeleteExtS
LdapOpenObject2
LdapSearchS
?SetAtDisabler@CLexer@@QAEXH@Z
SchemaGetClassInfo
LdapReadAttribute2
LdapMakeSchemaCacheObsolete
InitObjectInfo
LdapFirstEntry
SchemaGetClassInfoByIndex
ADSISetSearchPreference
ADsDeleteAttributeDefinition
LdapGetSchemaObjectCount
ADsGetObjectAttributes
LdapGetValues
BuildADsParentPathFromObjectInfo2
LdapTypeToAdsTypeDNWithString
LdapGetValuesLen
LdapRenameExtS
MapLDAPTypeToADSType
intcmp
ConvertSidToU2Trustee
LdapCacheAddRef
ADsWriteAttributeDefinition
LdapReadAttribute
ADSICreateDSObject
LdapMsgFree
ADsExecuteSearch
SchemaGetObjectCount
LdapSearchST
LdapTypeToAdsTypeCopyConstruct

kernel32

VirtualAlloc
QueueUserAPC
SetConsoleOutputCP
GetStartupInfoW
LocalShrink
SetHandleContext
CopyFileExW
lstrcatA
ReadProcessMemory
VirtualQueryEx
InterlockedExchangeAdd
GetExitCodeThread
Module32FirstW
SetConsoleTitleA
LoadLibraryA
GetModuleHandleExW
CreateFileMappingA
CreateActCtxW
LZDone
TzSpecificLocalTimeToSystemTime
FoldStringA
GetConsoleSelectionInfo
GetVDMCurrentDirectories
GetEnvironmentStringsA
SetCommState
OpenWaitableTimerW
DnsHostnameToComputerNameW
QueryMemoryResourceNotification
GetModuleHandleW
HeapCreate
SetTermsrvAppInstallMode
NlsGetCacheUpdateCount
GetCurrentActCtx
FlushViewOfFile
DeleteTimerQueue
GetCurrencyFormatA
GetPrivateProfileSectionNamesW
SetTimeZoneInformation
InitializeSListHead
LocalHandle
SetThreadExecutionState

Sections

.text
Size: 360KB - Virtual size: 360KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 374KB - Virtual size: 374KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 124KB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fbecdffad228eb402cf2bd16aaf3bc6d

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

gdi32

adsldpc

kernel32

Sections

.text Size: 360KB - Virtual size: 360KB

.rdata Size: 374KB - Virtual size: 374KB

.data Size: 124KB - Virtual size: 1.5MB

.rsrc Size: 1024B - Virtual size: 1024B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 360KB - Virtual size: 360KB

.rdata
Size: 374KB - Virtual size: 374KB

.data
Size: 124KB - Virtual size: 1.5MB

.rsrc
Size: 1024B - Virtual size: 1024B

.reloc
Size: 1KB - Virtual size: 1KB