08c5db2d4f6b372b91b4db385d32bef8

Sharing

Copy URL Twitter E-mail

General

Target

08c5db2d4f6b372b91b4db385d32bef8
Size

328KB
MD5

08c5db2d4f6b372b91b4db385d32bef8
SHA1

a12f6e0b39a9df794ede3e25e128fbd79b79ea61
SHA256

c1843023fa8d3d31110cf8edecd07dd10955d071f1fb519ee79e6726d4bd6d06
SHA512

09ffed416a7614942f6fb9223bb084279e7d2997fc27f3583423c886f533db93ce032f155c68bb42d87fc1d6419494c6eac44ef6b747649e18a82001e8e6d205
SSDEEP

6144:OrzQ62aZ7h+VOSy/p1Kc1/GfGxHoX6hCPHvEtIMRiPp:OlfL+VOlPKcBGf2I/omPp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
08c5db2d4f6b372b91b4db385d32bef8

Files

08c5db2d4f6b372b91b4db385d32bef8
.exe windows:5 windows x86 arch:x86

3a6a8c8b082713d065aaf2c59ca69461

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

CoTaskMemAlloc
CoCreateInstanceEx
CoSetProxyBlanket
CoTaskMemFree
StringFromCLSID
CoUninitialize
CoInitialize
CoCreateInstance

cryptui

CryptUIDlgSelectCA
CryptUIDlgFreeCAContext

netapi32

DsGetDcNameW
DsRoleGetPrimaryDomainInformation
NetShareGetInfo
DsRoleFreeMemory
NetShareAdd
NetShareDel
NetApiBufferFree

rpcrt4

RpcMgmtInqServerPrincNameW
NdrOleAllocate
RpcStringFreeW
IUnknown_AddRef_Proxy
RpcNetworkIsProtseqValidW
NdrDllCanUnloadNow
NdrClientCall2
RpcBindingFree
NdrDllGetClassObject
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
RpcEpResolveBinding
NdrDllRegisterProxy
NdrDllUnregisterProxy
CStdStubBuffer_AddRef
CStdStubBuffer_CountRefs
RpcCancelThreadEx
NdrCStdStubBuffer_Release
CStdStubBuffer_Connect
CStdStubBuffer_QueryInterface
NdrOleFree
RpcBindingSetAuthInfoW
IUnknown_Release_Proxy
IUnknown_QueryInterface_Proxy
RpcBindingFromStringBindingW
RpcStringBindingComposeW
CStdStubBuffer_DebugServerQueryInterface

msvcrt

wcsncpy
_errno
_iob
_wcsicmp
wcsrchr
strcspn
isupper
_wtol
vfwprintf
wcstol
wcstoul
_initterm
getenv
wcsstr
wcscmp
free
ftell
isxdigit
_adjust_fdiv
wcslen
swprintf
malloc
wcscat
fopen
wcstok
__isascii
fprintf
fflush
wcschr
fclose
_snprintf
fwprintf
_wtoi
swscanf
fseek
_snwprintf
strncmp
_wcsnicmp
memmove
isdigit
fputs
sprintf
strchr
wcscpy
_vsnprintf
atoi
_except_handler3

user32

LoadStringW
wsprintfW
GetDesktopWindow

advapi32

RegQueryValueExW
RegEnumKeyExW
GetSecurityDescriptorLength
RegCreateKeyW
CryptGenRandom
RegOpenCurrentUser
MakeSelfRelativeSD
CryptAcquireContextA
RegConnectRegistryW
LsaClose
AccessCheckByType
CopySid
RegDeleteValueW
GetLengthSid
RegCreateKeyExW
MakeAbsoluteSD
RegCloseKey
DuplicateToken
LsaOpenPolicy
RegDeleteKeyW
OpenProcessToken
RegOpenKeyW
AllocateAndInitializeSid
RegQueryInfoKeyW
CryptReleaseContext
RegOpenKeyExW
LsaNtStatusToWinError
LsaFreeMemory
FreeSid
EqualSid
SetSecurityDescriptorOwner
RegSetValueExW
RegEnumValueW
LsaQueryInformationPolicy
OpenThreadToken
GetTokenInformation
IsValidSecurityDescriptor

kernel32

GetCurrentThreadId
WaitForSingleObject
WriteConsoleW
LoadLibraryW
lstrcmpiW
FileTimeToLocalFileTime
InterlockedIncrement
GetVersionExW
UnhandledExceptionFilter
RegisterWaitForSingleObject
WideCharToMultiByte
CloseHandle
GetModuleFileNameW
SetUnhandledExceptionFilter
MultiByteToWideChar
TerminateProcess
GetConsoleOutputCP
GetFileSize
FormatMessageW
GetModuleHandleW
InitializeCriticalSection
GetTickCount
GetLastError
GetSystemTime
lstrcmpW
GetDateFormatW
QueryPerformanceCounter
SetLastError
GetCurrentProcessId
GetTimeFormatW
DebugBreak
DeleteCriticalSection
GetComputerNameW
GetSystemTimeAsFileTime
GetComputerNameExW
LocalReAlloc
GetCurrentThread
CreateFileW
GetACP
DuplicateHandle
GetSystemDirectoryW
InterlockedDecrement
LocalFree
FreeLibrary
GetProcAddress
GetFileType
GetEnvironmentVariableA
GetStdHandle
CreateEventW
FileTimeToSystemTime
GetWindowsDirectoryA
EnterCriticalSection
CompareFileTime
LeaveCriticalSection
CreateThread
SystemTimeToFileTime
OutputDebugStringA
LocalAlloc
Sleep
IsDebuggerPresent
GetExitCodeThread
GetEnvironmentVariableW
ReadFile
lstrlenW
UnregisterWait
DisableThreadLibraryCalls
WriteFile
GetCurrentProcess

ntdll

qsort
NtAllocateVirtualMemory
strlen

crypt32

CertCreateCertificateContext
CryptHashCertificate
CertGetNameStringW
CryptMsgOpenToDecode
CertDuplicateCertificateContext
CertGetCertificateContextProperty
CryptMsgClose
CertFindCertificateInStore
CertFreeCertificateChain
CryptMsgUpdate
CryptEncodeObject
CryptSignMessage
CryptMsgEncodeAndSignCTL
CertDeleteCTLFromStore
CertFreeCertificateContext
CertFindExtension
CertStrToNameW
CertCloseStore
CertVerifyCertificateChainPolicy
CertNameToStrW
CertOpenStore
CertAddEncodedCTLToStore
CryptFindOIDInfo
CertFindCTLInStore
CryptMsgGetParam
CryptDecodeObjectEx
CertGetCertificateChain
CryptDecodeObject
CryptEncodeObjectEx

secur32

FreeContextBuffer
QueryCredentialsAttributesW
AcceptSecurityContext
AcquireCredentialsHandleW
DeleteSecurityContext
InitializeSecurityContextW
FreeCredentialsHandle
QuerySecurityContextToken
EnumerateSecurityPackagesW

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 163KB - Virtual size: 162KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 98KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

3a6a8c8b082713d065aaf2c59ca69461

Headers

DLL Characteristics

File Characteristics

Imports

ole32

cryptui

netapi32

rpcrt4

msvcrt

user32

advapi32

kernel32

ntdll

crypt32

secur32

Sections

.text Size: 26KB - Virtual size: 25KB

.rdata Size: 163KB - Virtual size: 162KB

.rsrc Size: 98KB - Virtual size: 97KB

.data Size: 40KB - Virtual size: 1.4MB

.tls Size: 512B - Virtual size: 4KB

.text
Size: 26KB - Virtual size: 25KB

.rdata
Size: 163KB - Virtual size: 162KB

.rsrc
Size: 98KB - Virtual size: 97KB

.data
Size: 40KB - Virtual size: 1.4MB

.tls
Size: 512B - Virtual size: 4KB