ae32c9b76584c620cf10043f9e9c0d50

General

Target

ae32c9b76584c620cf10043f9e9c0d50
Size

83KB
MD5

ae32c9b76584c620cf10043f9e9c0d50
SHA1

988a985a814840c6798c8bafdafc8c592c9c9fde
SHA256

c5a37cdcdb23b44931934be5005a033458907a94913270798f2e8394750ebb4d
SHA512

22016873048fb884ecd3c4b11192d8f0f0ec84f15cefa9c2936523677e108317b930d9b72271415365e9a028c73b9d1d4fcb42c431f46b419fdfbb87310965f4
SSDEEP

1536:NRmVIt/i6gVwsD42Vh66kPllMO+UKwoTBxKblDOQB0HrMmDfTtvuvY/0Q:NMVIgQALkdlMOYwiY3B0LrjQk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ae32c9b76584c620cf10043f9e9c0d50

Files

ae32c9b76584c620cf10043f9e9c0d50
.exe windows:5 windows x86 arch:x86

c3f60eaac6e0f1b5e577a05c56421464

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt20

??0strstreambuf@@QAE@H@Z
_wcsnicmp
tmpfile
_utime
__threadhandle
??0filebuf@@QAE@HPADH@Z
??0iostream@@IAE@ABV0@@Z
??4Iostream_init@@QAEAAV0@ABV0@@Z
_isnan
_spawnvpe
_CIsqrt
_getdcwd
iswascii

kernel32

LocalShrink
GetTickCount
GetConsoleCP
MapViewOfFileEx
FatalAppExitA
VirtualAlloc
GetCurrentThreadId
QueryPerformanceCounter
WideCharToMultiByte
GetSystemTimeAsFileTime
OpenWaitableTimerA
GetCurrentProcessId
GetNumaHighestNodeNumber
ReadConsoleOutputW
lstrcpy
SetClientTimeZoneInformation
LoadLibraryA
DosDateTimeToFileTime
FindActCtxSectionStringW

ntdsapi

DsCrackSpn2A
DsReplicaSyncAllA
DsQuoteRdnValueW
DsBindWithCredA
DsaopBindWithCred
DsaopUnBind
DsFreeNameResultA
DsMapSchemaGuidsA
DsIsMangledRdnValueW
DsAddSidHistoryW
DsReplicaConsistencyCheck
DsReplicaGetInfoW
DsListDomainsInSiteW
DsBindW
DsReplicaModifyA

sensapi

IsDestinationReachableA
IsNetworkAlive
IsDestinationReachableW

Sections

.text
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c3f60eaac6e0f1b5e577a05c56421464

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt20

kernel32

ntdsapi

sensapi

Sections

.text Size: 39KB - Virtual size: 39KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 20KB - Virtual size: 27KB

.rsrc Size: 21KB - Virtual size: 20KB

.reloc Size: 512B - Virtual size: 248B

.text
Size: 39KB - Virtual size: 39KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 20KB - Virtual size: 27KB

.rsrc
Size: 21KB - Virtual size: 20KB

.reloc
Size: 512B - Virtual size: 248B