a06d7b60be9dc666c2bc9fd8a2b5fb77

Sharing

Copy URL Twitter E-mail

General

Target

a06d7b60be9dc666c2bc9fd8a2b5fb77
Size

147KB
MD5

a06d7b60be9dc666c2bc9fd8a2b5fb77
SHA1

9f6ca72876ccb3f72eb488ba53c61be501529d43
SHA256

9a1e2179367ee36134946c9d0dcfb435d5d472fb06ebe805e54fe9477c723532
SHA512

b02c4dbd20d9e0772055dfa7ced0e836d40844dd98f7faf65acc3ec40ebde6f9cdbe2983d8cd30a5c5a0ac4dd29de97b073a5ab676f2f25e29cddfdc5c82f6f8
SSDEEP

3072:T16JeczFBZahmP2xkXJSQdrCiH57XQcsnylqowweE99vAeDx3:T1ce2FBZrkQdrCw5DwnylqeeyvA8V

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a06d7b60be9dc666c2bc9fd8a2b5fb77

Files

a06d7b60be9dc666c2bc9fd8a2b5fb77
.exe windows:5 windows x86 arch:x86

dc00ca98bc8a99c0b05b1ef7711809f5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlRandomEx
NtPrivilegedServiceAuditAlarm
ZwSetSecurityObject
NtQueryIoCompletion
ZwDuplicateObject
ZwSetSystemPowerState
NtNotifyChangeKey
RtlLargeIntegerToChar
RtlAddAttributeActionToRXact
RtlAddAccessDeniedAceEx
wcscat
ZwReplyWaitReceivePortEx
ZwClose
NtSetTimerResolution
RtlFirstEntrySList
RtlRealSuccessor
_aullshr
KiUserCallbackDispatcher
RtlSplay
RtlUnhandledExceptionFilter2
RtlNumberGenericTableElements
RtlZeroHeap
ZwCreateIoCompletion
sprintf
CsrIdentifyAlertableThread
ZwAccessCheckByTypeResultList
ZwTerminateThread
NtIsSystemResumeAutomatic
NtImpersonateAnonymousToken
_vsnwprintf
ZwWriteFile
RtlDestroyEnvironment
RtlDestroyProcessParameters
LdrAddRefDll
NtRestoreKey
NtOpenEventPair
NtWaitLowEventPair
NtAdjustGroupsToken
ZwQueryKey
ZwQueryTimer
RtlIsActivationContextActive
wcscspn
sqrt

kernel32

GetCurrentDirectoryW
SetFileApisToANSI
LZRead
lstrcpynA
Heap32First
LZClose
GetLastError
GetExitCodeProcess
SetSystemTimeAdjustment
GetVolumeInformationW
PrepareTape
SetSystemPowerState
FindFirstVolumeW
ReadFileEx
LoadLibraryA
LocalFree
GetSystemTimeAsFileTime
FatalAppExitW
FindResourceExW
WriteFileGather
FindVolumeClose
VirtualAlloc
SetFilePointer
GetTimeZoneInformation
BackupRead
GetModuleFileNameA
IsWow64Process
VirtualProtectEx
ReadConsoleInputA
FreeUserPhysicalPages
CancelTimerQueueTimer
IsProcessInJob
GetCurrentConsoleFont
CreateHardLinkA
SetThreadAffinityMask
MulDiv
LocalReAlloc
RtlZeroMemory
GlobalFindAtomA
SetCommTimeouts

cfgmgr32

CM_Free_Log_Conf
CM_Get_Device_Interface_ListA
CM_Set_HW_Prof_FlagsA
CM_Get_Device_Interface_ListW
CM_Modify_Res_Des
CM_Get_Class_Key_Name_ExA
CM_Next_Range
CM_Free_Range_List
CM_Set_DevNode_Registry_PropertyW
CM_Unregister_Device_Interface_ExA
CM_Get_Device_Interface_List_ExW
CM_Request_Eject_PC_Ex
CM_Register_Device_Driver
CM_Run_Detection
CM_Uninstall_DevNode_Ex
CM_Remove_SubTree_Ex
CM_Create_DevNodeW
CM_Delete_DevNode_Key_Ex
CM_Get_Res_Des_Data_Size_Ex
CM_Get_Device_Interface_Alias_ExA
CM_Get_Device_Interface_List_SizeW
CM_Add_Res_Des
CM_Enumerate_Enumerators_ExW
CM_Open_Class_KeyW
CM_Register_Device_Interface_ExW
CM_Get_Device_ID_List_SizeW
CM_Move_DevNode_Ex
CM_Add_ID_ExA
CM_Enumerate_EnumeratorsW
CM_Get_Parent_Ex
CM_Get_HW_Prof_Flags_ExA

mapi32

HrValidateParameters@8
FBadEntryList@4
MAPIUninitialize@0
HrGetOmiProvidersFlags@8
FtgRegisterIdleRoutine@20
__CPPValidateParameters@8
LpValFindProp@12
HrQueryAllRows@24
UlAddRef@4
MAPILogonEx
EncodeID@12
FBadRglpszW@8
UNKOBJ_ScCOAllocate@12
MAPIOpenLocalFormContainer@4
OpenStreamOnFile@24
BuildDisplayTable@40
SwapPword@8
FBadProp@4
MAPIReadMail
UNKOBJ_Free@8
CchOfEncoding@4
MAPIAllocateMore@12
FBadColumnSet@4
ScRelocNotifications@20
MNLS_CompareStringW@24
UNKOBJ_ScSzFromIdsAlloc@20
ScCountProps@12
BMAPISaveMail
HrSzFromEntryID@12
FtAdcFt@20

advapi32

EncryptedFileKeyInfo
SystemFunction030
SetUserFileEncryptionKey
ElfRegisterEventSourceA
LookupPrivilegeValueW
AddAce
CredFree
CryptDeriveKey
GetLocalManagedApplications
AddAuditAccessAceEx
ObjectDeleteAuditAlarmW
WmiQuerySingleInstanceMultipleA
ChangeServiceConfigA
CryptContextAddRef
ConvertSecurityDescriptorToStringSecurityDescriptorA
SaferiIsExecutableFileType
LsaSetSecret
ImpersonateAnonymousToken
CryptGetUserKey
SystemFunction010
LsaQueryTrustedDomainInfo
GetOldestEventLogRecord
LookupPrivilegeDisplayNameA
RegOpenUserClassesRoot
SetKernelObjectSecurity
GetSecurityInfoExW
SystemFunction003
StartServiceW
LsaRetrievePrivateData
QueryServiceConfig2W
ConvertSecurityDescriptorToAccessW
LsaQueryTrustedDomainInfoByName
CredEnumerateW
DecryptFileW
CloseTrace
ConvertSecurityDescriptorToAccessA
AreAllAccessesGranted
SetEntriesInAccessListW
CredWriteW
CredGetSessionTypes

iasacct

DllGetClassObject

adsldpc

LdapTypeCopyConstruct
FindSearchTableIndex
LdapTypeToAdsTypeDNWithBinary
LdapModifyExtS
BuildADsPathFromParent
LdapModifyS
ADSIGetPreviousRow
??1CLexer@@QAE@XZ
LdapControlsFree
LdapSearchExtS
ADsGetFirstRow
AdsTypeToLdapTypeCopyGeneralizedTime
SchemaAddRef
SchemaOpen
ADSISetSearchPreference
ADsCreateClassDefinition
LdapIsClassNameValidOnServer
ADsGetLastError
ADsObject
IsGCNamespace
LdapResult
?GetNextToken@CLexer@@QAEJPAGPAK@Z
LdapDeleteS
SchemaGetObjectCount
GetDisplayName
intcmp
ADsCreateDSObjectExt
ConvertSidToU2Trustee
AdsTypeToLdapTypeCopyTime
LdapSearchAbandonPage

Sections

.text
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 180KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dc00ca98bc8a99c0b05b1ef7711809f5

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

cfgmgr32

mapi32

advapi32

iasacct

adsldpc

Sections

.text Size: 68KB - Virtual size: 68KB

.rdata Size: 56KB - Virtual size: 56KB

.data Size: 19KB - Virtual size: 180KB

.rsrc Size: 1024B - Virtual size: 1024B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 68KB - Virtual size: 68KB

.rdata
Size: 56KB - Virtual size: 56KB

.data
Size: 19KB - Virtual size: 180KB

.rsrc
Size: 1024B - Virtual size: 1024B

.reloc
Size: 1KB - Virtual size: 1KB