3fac140352e13a49d6b8d77ec8b8a728

Sharing

Copy URL Twitter E-mail

General

Target

3fac140352e13a49d6b8d77ec8b8a728
Size

140KB
MD5

3fac140352e13a49d6b8d77ec8b8a728
SHA1

80f15e8955d8ff622414b8184f7923c8f7d75398
SHA256

e58ac0611125aa222397e3026e6fd4a2a117accad163a075fb05b8c76f00b7a1
SHA512

4ec2cf2fd5d0801e6a0e6170cb4f05d70a8e7d938c964d57ce1b8bd0fa232590d44ecf4727334e78285588fcc905ecd17a7bfb602a221c92b7501cded51b1977
SSDEEP

3072:c01as5ExiHYpaqQ0wX+RrhFCguxInlk7k6GwQ:us5EkYXjrugkm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3fac140352e13a49d6b8d77ec8b8a728

Files

3fac140352e13a49d6b8d77ec8b8a728
.dll windows:5 windows x86 arch:x86

a048bb4f0b079a68d166b3b3d409b471

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

RegCreateKeyExW
OpenThreadToken
OpenProcessToken
LsaFreeMemory
LsaGetUserName
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
GetTokenInformation
GetSidSubAuthority
GetSidSubAuthorityCount
GetSidIdentifierAuthority
IsValidSid
GetSidLengthRequired
SystemFunction040
SystemFunction041
RegSetValueExW

kernel32

MultiByteToWideChar
InitializeCriticalSection
FreeLibrary
DeleteCriticalSection
CompareStringW
GetProcAddress
LoadLibraryW
GetLastError
GetCurrentThread
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
LocalFree
LocalAlloc
GetCurrentProcessId
GetCurrentProcess
CloseHandle
GetTickCount
FileTimeToSystemTime
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
ReadFile
GetFileSize
CreateFileW
WriteFile
DeleteFileW
CreateDirectoryW
ExpandEnvironmentStringsW
lstrlenW
CompareFileTime
QueryPerformanceCounter
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError

msvcrt

bsearch
_except_handler3
wcscpy
wcslen
wcsncpy
_wcsicmp
wcschr
swscanf
_wtol
wcscmp
wcstoul
_itow
swprintf
wcscat
_adjust_fdiv
malloc
_initterm
free
qsort
_wcsnicmp
wcsstr
wcsrchr
wcsncat
iswdigit
_wtoi

netapi32

NetWkstaGetInfo
NetApiBufferFree

ntdll

RtlInitUnicodeString

user32

LoadStringW
wsprintfW

wldap32

ord13
ord10
ord41
ord36
ord167
ord224
ord79
ord18
ord203
ord194
ord16
ord206
ord134
ord135
ord138
ord191
ord116
ord100
ord173
ord319
ord321
ord179
ord91
ord88
ord145
ord219
ord210
ord208
ord54
ord157
ord155
ord165
ord188
ord161
ord69
ord65
ord113
ord111
ord85
ord40
ord26
ord27
ord127
ord97
ord140
ord77
ord142
ord133
ord73
ord216
ord29
ord53
ord300
ord311
ord301
ord94
ord12
ord120
ord147
ord146
ord304
ord310
ord190
ord309
ord14

Exports

Exports

??0CLexer@@QAE@PAG@Z
??1CLexer@@QAE@XZ
?GetNextToken@CLexer@@QAEJPAGPAK@Z
?SetAtDisabler@CLexer@@QAEXH@Z
?SetExclaimnationDisabler@CLexer@@QAEXH@Z
?SetFSlashDisabler@CLexer@@QAEXH@Z
ADSIAbandonSearch
ADSICloseDSObject
ADSICloseSearchHandle
ADSICreateDSObject
ADSIDeleteDSObject
ADSIExecuteSearch
ADSIFreeColumn
ADSIGetColumn
ADSIGetFirstRow
ADSIGetNextColumnName
ADSIGetNextRow
ADSIGetObjectAttributes
ADSIGetPreviousRow
ADSIModifyRdn
ADSIOpenDSObject
ADSISetObjectAttributes
ADSISetSearchPreference
ADsAbandonSearch
ADsCloseSearchHandle
ADsCreateAttributeDefinition
ADsCreateClassDefinition
ADsCreateDSObject
ADsCreateDSObjectExt
ADsDecodeBinaryData
ADsDeleteAttributeDefinition
ADsDeleteClassDefinition
ADsDeleteDSObject
ADsEncodeBinaryData
ADsEnumAttributes
ADsEnumClasses
ADsExecuteSearch
ADsFreeColumn
ADsGetColumn
ADsGetFirstRow
ADsGetLastError
ADsGetNextColumnName
ADsGetNextRow
ADsGetObjectAttributes
ADsGetPreviousRow
ADsHelperGetCurrentRowMessage
ADsObject
ADsSetLastError
ADsSetObjectAttributes
ADsSetSearchPreference
ADsWriteAttributeDefinition
ADsWriteClassDefinition
AdsTypeFreeAdsObjects
AdsTypeToLdapTypeCopyConstruct
AdsTypeToLdapTypeCopyDNWithBinary
AdsTypeToLdapTypeCopyDNWithString
AdsTypeToLdapTypeCopyGeneralizedTime
AdsTypeToLdapTypeCopyTime
AllocADsMem
AllocADsStr
BerBvFree
BuildADsParentPath
BuildADsParentPathFromObjectInfo
BuildADsParentPathFromObjectInfo2
BuildADsPathFromLDAPPath
BuildADsPathFromLDAPPath2
BuildADsPathFromParent
BuildLDAPPathFromADsPath
BuildLDAPPathFromADsPath2
ChangeSeparator
Component
ConvertSidToString
ConvertSidToU2Trustee
ConvertU2TrusteeToSid
FindEntryInSearchTable
FindSearchTableIndex
FreeADsMem
FreeADsStr
FreeObjectInfo
GetDefaultServer
GetDisplayName
GetDomainDNSNameForDomain
GetLDAPTypeName
GetSyntaxOfAttribute
InitObjectInfo
IsGCNamespace
LdapAddExtS
LdapAddS
LdapAttributeFree
LdapCacheAddRef
LdapCloseObject
LdapCompareExt
LdapControlFree
LdapControlsFree
LdapCountEntries
LdapCrackUserDNtoNTLMUser
LdapCrackUserDNtoNTLMUser2
LdapCreatePageControl
LdapDeleteExtS
LdapDeleteS
LdapFirstAttribute
LdapFirstEntry
LdapGetDn
LdapGetNextPageS
LdapGetSchemaObjectCount
LdapGetSubSchemaSubEntryPath
LdapGetSyntaxIdOfAttribute
LdapGetSyntaxOfAttributeOnServer
LdapGetValues
LdapGetValuesLen
LdapInitializeSearchPreferences
LdapIsClassNameValidOnServer
LdapMakeSchemaCacheObsolete
LdapMemFree
LdapModDnS
LdapModifyExtS
LdapModifyS
LdapMsgFree
LdapNextAttribute
LdapNextEntry
LdapOpenObject
LdapOpenObject2
LdapParsePageControl
LdapParseResult
LdapReadAttribute
LdapReadAttribute2
LdapReadAttributeFast
LdapRenameExtS
LdapResult
LdapSearch
LdapSearchAbandonPage
LdapSearchExtS
LdapSearchInitPage
LdapSearchS
LdapSearchST
LdapTypeBinaryToString
LdapTypeCopyConstruct
LdapTypeFreeLdapModList
LdapTypeFreeLdapModObject
LdapTypeFreeLdapObjects
LdapTypeToAdsTypeCopyConstruct
LdapTypeToAdsTypeDNWithBinary
LdapTypeToAdsTypeDNWithString
LdapTypeToAdsTypeGeneralizedTime
LdapTypeToAdsTypeUTCTime
LdapValueFree
LdapValueFreeLen
LdapcKeepHandleAround
LdapcSetStickyServer
MapADSTypeToLDAPType
MapLDAPTypeToADSType
PathName
ReadPagingSupportedAttr
ReadSecurityDescriptorControlType
ReadServerSupportsIsADControl
ReallocADsMem
ReallocADsStr
SchemaAddRef
SchemaClose
SchemaGetClassInfo
SchemaGetClassInfoByIndex
SchemaGetObjectCount
SchemaGetPropertyInfo
SchemaGetPropertyInfoByIndex
SchemaGetStringsFromStringTable
SchemaGetSyntaxOfAttribute
SchemaIsClassAContainer
SchemaOpen
SortAndRemoveDuplicateOIDs
UnMarshallLDAPToLDAPSynID
intcmp

Sections

.text
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a048bb4f0b079a68d166b3b3d409b471

Headers

File Characteristics

Imports

advapi32

kernel32

msvcrt

netapi32

ntdll

user32

wldap32

Exports

Exports

Sections

.text Size: 132KB - Virtual size: 131KB

.data Size: 2KB - Virtual size: 2KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 132KB - Virtual size: 131KB

.data
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 2KB