b5e8dda4b5cddaf5b4f184f87f9bac2a

Sharing

Copy URL Twitter E-mail

General

Target

b5e8dda4b5cddaf5b4f184f87f9bac2a
Size

122KB
MD5

b5e8dda4b5cddaf5b4f184f87f9bac2a
SHA1

32a4ddcf2736509488cac938ef6b9d0d31f4cee4
SHA256

30c78a2de1d0227c99aa4d06f973ad93505e2a79085407e77988daf68a82a478
SHA512

7b97b0a1fa8be95ff55769a36d1a3eab237c68b736c68d17481ba5f7053e0c0c7bcde2e8d111d8083cd6174530e0eaee7a0943c5f90270bef0a3f8139dd601cf
SSDEEP

3072:BCmddR1OA2M+FOCY2BROLiF/7uLoYutcBfA06tg0:BCIRcA2M+GMzSuatA0ex

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b5e8dda4b5cddaf5b4f184f87f9bac2a

Files

b5e8dda4b5cddaf5b4f184f87f9bac2a
.exe windows:5 windows x86 arch:x86

2bda5d4862cd6314a57f20bcc787f602

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

adsldpc

LdapGetDn
ADSIExecuteSearch
ChangeSeparator
LdapTypeToAdsTypeUTCTime
ADSICloseSearchHandle
LdapGetSubSchemaSubEntryPath
LdapAddExtS
AllocADsStr
LdapSearchST
ADSICreateDSObject
ADsDeleteDSObject
LdapOpenObject2
ADSIOpenDSObject
LdapOpenObject
ADsDeleteAttributeDefinition
GetDisplayName
ADSISetSearchPreference
?SetFSlashDisabler@CLexer@@QAEXH@Z
SchemaGetClassInfoByIndex
ADsDeleteClassDefinition
LdapTypeBinaryToString
ADsEnumAttributes
LdapCreatePageControl
ADSIGetColumn
LdapSearch
PathName
SchemaIsClassAContainer
ADsGetNextColumnName

winmm

midiOutGetDevCapsW
mci32Message
joy32Message
mmioStringToFOURCCW
waveInMessage
midiOutShortMsg
mmioDescend
DrvGetModuleHandle
waveOutSetVolume
mmioWrite
mixerMessage
mciGetErrorStringA
mmioSendMessage
mciDriverNotify
mixerGetID
joySetThreshold
midiStreamPosition
timeBeginPeriod
waveOutGetDevCapsW
midiInGetDevCapsA
mciFreeCommandResource
mixerGetLineInfoA
DriverCallback
midiOutPrepareHeader
mixerGetLineInfoW
mmsystemGetVersion
mmioRenameA
midiOutReset
mmioRenameW
OpenDriver
waveOutClose
midiOutGetID
midiInReset
mciGetDeviceIDFromElementIDA
midiInGetErrorTextA

kernel32

GetCPInfo
SetFirmwareEnvironmentVariableA
FindCloseChangeNotification
GetPrivateProfileStringW
FindFirstVolumeMountPointA
CompareFileTime
GlobalAlloc
GetThreadTimes
CreateTimerQueueTimer
lstrcat
GetModuleHandleA
SetVolumeMountPointW
EnumResourceTypesA
GetConsoleCommandHistoryW
GetConsoleHardwareState
ExpandEnvironmentStringsW
ExpandEnvironmentStringsA
HeapCreate
VerifyConsoleIoHandle
GetVersionExW
GetConsoleOutputCP
GetConsoleKeyboardLayoutNameA
BeginUpdateResourceA
IsBadHugeReadPtr
CallNamedPipeW
HeapUnlock
VirtualAlloc
Heap32ListNext
ZombifyActCtx
DeleteFiber
LZCreateFileW
lstrcmpA
GetSystemInfo
GetConsoleCommandHistoryA
MapViewOfFile
GetExpandedNameA
QueryInformationJobObject
Thread32First
LockResource
WritePrivateProfileSectionW
lstrcpy
SetSystemTime
GlobalUnfix
GetCurrencyFormatA
lstrlenW
lstrlenA
LoadLibraryA
SetLastError
ReadConsoleOutputAttribute
FindNextChangeNotification
VirtualFree
PeekConsoleInputW
lstrcmpi
DeactivateActCtx
SetFileShortNameW
QueueUserAPC
HeapValidate
GetACP
GetStartupInfoA

msvcrt

__p__acmdln
_wspawnlp
_abnormal_termination
_strupr
wcstoul
_strnset
_getwch
fsetpos
_local_unwind2
strcspn
__fpecode
_rotl
_finite
_mbsstr
__iob_func
swprintf
__CxxQueryExceptionSize
wctomb
__p__commode
_scprintf
log10
exit
__lc_handle
vfwprintf
_mktime64
__set_app_type
wcsftime
_wexecvp

Sections

.text
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2bda5d4862cd6314a57f20bcc787f602

Headers

DLL Characteristics

File Characteristics

Imports

adsldpc

winmm

kernel32

msvcrt

Sections

.text Size: 50KB - Virtual size: 50KB

.rdata Size: 68KB - Virtual size: 164KB

.rsrc Size: 2KB - Virtual size: 1KB

.text
Size: 50KB - Virtual size: 50KB

.rdata
Size: 68KB - Virtual size: 164KB

.rsrc
Size: 2KB - Virtual size: 1KB