4d570c328af241cb7f0f2d2a0aa95906

Sharing

Copy URL

Twitter E-mail

General

Target

4d570c328af241cb7f0f2d2a0aa95906
Size

819KB
MD5

4d570c328af241cb7f0f2d2a0aa95906
SHA1

2ff1bf02afa8ec101439d5e7946848a7b0364d2c
SHA256

7815c3f6bd6f4ab1a177e1c61036c58037a8230eb26971e1f9da4899e9eee716
SHA512

3014dbfe5421e06a92b44dcdda403180e8811d1ecaaacb42d32b4a46d91a88e8bc83b4760f7e9d243c60004152064160d4ce74b8b9ad40bd573041fa72baa784
SSDEEP

12288:VCe0uqnMQQp6KdUxQLszfDzCMssy4dO5BxeXV48e+Tp26tZQwJyiHVHl/:VD0uqnMjp6Kdp+fiI6xea8e6vFb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4d570c328af241cb7f0f2d2a0aa95906

Files

4d570c328af241cb7f0f2d2a0aa95906
.exe windows:5 windows x86 arch:x86

67df0d01798c6c7d52e2f8bc97c43f47

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

odbc32

PostODBCError
SQLGetFunctions
SQLNumResultCols
SQLColumnsW
SQLGetConnectOptionW
SQLForeignKeys
SQLColAttributesW
SQLPrepare
SQLExecDirect
SQLFetch
SQLGetInfoW
SQLSetCursorName
SQLBindParameter
SQLDescribeColA
SQLDrivers
SQLGetCursorName
SQLGetCursorNameW
SQLGetDiagRec
SQLGetDiagFieldA
SQLSetStmtOption
SQLFetchScroll
SQLSetStmtAttr
SQLColAttributeW
SQLSetDescFieldW
SQLStatisticsW
SQLTablePrivilegesA
SQLAllocHandleStd
SQLForeignKeysW
SQLTablePrivileges
g_hHeapMalloc
SQLColumnsA
SQLGetData
SQLSetDescFieldA
SQLBindParam
SQLGetStmtAttr
SQLStatistics
SQLConnectA
SQLExtendedFetch
SQLDataSourcesA
SQLExecDirectA
PostODBCComponentError
SQLPrimaryKeysW
SQLTransact
SQLSetCursorNameA

kernel32

InterlockedPushEntrySList
MapUserPhysicalPages
LoadModule
OpenProfileUserMapping
CreateTimerQueueTimer
IsBadCodePtr
GetProcessAffinityMask
RegisterConsoleVDM
SetVolumeLabelW
GlobalSize
GetSystemPowerStatus
LoadLibraryA
DeleteCriticalSection
GetProfileSectionW
LockResource
BaseFlushAppcompatCache
IsBadReadPtr
GetSystemTimeAsFileTime
GetVDMCurrentDirectories
QueryActCtxW
GetNumaNodeProcessorMask
GetCurrencyFormatW
CallNamedPipeA
SetThreadUILanguage
DuplicateConsoleHandle
AddConsoleAliasW
RegisterWaitForInputIdle
LZStart
SwitchToThread
PrivCopyFileExW
BeginUpdateResourceA
GetLastError
DeactivateActCtx
VirtualAlloc
OpenEventA
LZRead
WriteProcessMemory

dsprop

DllGetClassObject
DllRegisterServer
ADsPropGetInitInfo
ADsPropSetHwnd
DllUnregisterServer
ADsPropCheckIfWritable
DllCanUnloadNow
ADsPropCreateNotifyObj

crtdll

getenv
_osversion_dll
frexp
_HUGE_dll
_acmdln_dll
_umask
_dup
iswcntrl
_seterrormode
_isnan
_strnset
rewind
longjmp
wcscspn
div
vprintf
_findnext
towupper
isupper
_ismbclower
_strdec
setvbuf
_mbsnccnt
_mbsncpy
_execv
strftime
_fpclass
_vsnprintf
fprintf
wcsstr
_winmajor_dll
_CIsin
mbtowc

expsrv

CreateIExprSrvObj
rtcPackDate
EbGetHandleOfExecutingProject
rtcHexVarFromVar
rtcEndOfFile
__vbaR8ForNextCheck
__vbaVarTextLike
GetMem8
__vbaVarTextCmpLt
BASIC_CLASS_GetIDsOfNames
_adj_fdiv_r
__vbaInStr
__vbaVarOr
_CIsin
__vbaPutOwner3
rtcMakeDir
__vbaVarDup
__vbaR8IntI2
rtcLeftTrimVar
__vbaVarCat
rtcFileReset
__vbaLsetFixstrFree
Zombie_QueryInterface
GetMemVar
__vbaCyI4
__vbaVargUnkAddref

advapi32

BuildTrusteeWithObjectsAndSidW
TreeResetNamedSecurityInfoA
SystemFunction028
GetFileSecurityA
SetSecurityDescriptorDacl
QueryServiceLockStatusA
QueryRecoveryAgentsOnEncryptedFile
TreeResetNamedSecurityInfoW
CreateCodeAuthzLevel
PrivilegedServiceAuditAlarmA
SaferiIsExecutableFileType
AccessCheckAndAuditAlarmA
MD5Update
CryptDuplicateKey
GetPrivateObjectSecurity
ObjectOpenAuditAlarmW
LsaAddPrivilegesToAccount
RegLoadKeyA
GetExplicitEntriesFromAclW
EncryptionDisable
SystemFunction001
GetOverlappedAccessResults
BuildTrusteeWithNameA
LookupSecurityDescriptorPartsW
CredWriteW
GetSecurityDescriptorDacl
RegOverridePredefKey
CredFree
WmiQuerySingleInstanceA
BuildImpersonateExplicitAccessWithNameA
LsaEnumerateAccountsWithUserRight
ChangeServiceConfigW
CryptEnumProvidersA
GetServiceDisplayNameW
CredUnmarshalCredentialA
DeleteAce
CredReadDomainCredentialsA

wtsapi32

WTSVirtualChannelPurgeInput
WTSQueryUserConfigW
WTSEnumerateServersA
WTSSetSessionInformationW
WTSTerminateProcess
WTSEnumerateProcessesW
WTSSendMessageW
WTSVirtualChannelPurgeOutput
WTSCloseServer
WTSUnRegisterSessionNotification
WTSQueryUserConfigA
WTSSendMessageA
WTSOpenServerW
WTSEnumerateServersW
WTSVirtualChannelClose
WTSFreeMemory
WTSEnumerateSessionsA
WTSVirtualChannelWrite
WTSShutdownSystem
WTSOpenServerA
WTSQueryUserToken
WTSSetUserConfigA
WTSSetUserConfigW
WTSEnumerateProcessesA
WTSWaitSystemEvent
WTSQuerySessionInformationA
WTSQuerySessionInformationW
WTSRegisterSessionNotification
WTSLogoffSession
WTSDisconnectSession
WTSEnumerateSessionsW
WTSSetSessionInformationA
WTSVirtualChannelOpen
WTSVirtualChannelQuery
WTSVirtualChannelRead

Sections

.text
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 628KB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

67df0d01798c6c7d52e2f8bc97c43f47

Headers

DLL Characteristics

File Characteristics

Imports

odbc32

kernel32

dsprop

crtdll

expsrv

advapi32

wtsapi32

Sections

.text Size: 75KB - Virtual size: 74KB

.rdata Size: 108KB - Virtual size: 108KB

.data Size: 628KB - Virtual size: 2.0MB

.rsrc Size: 6KB - Virtual size: 6KB

.reloc Size: 512B - Virtual size: 312B

.text
Size: 75KB - Virtual size: 74KB

.rdata
Size: 108KB - Virtual size: 108KB

.data
Size: 628KB - Virtual size: 2.0MB

.rsrc
Size: 6KB - Virtual size: 6KB

.reloc
Size: 512B - Virtual size: 312B