c4a2b05334238d28f4f56381b1306d8c

Sharing

Copy URL

Twitter E-mail

General

Target

c4a2b05334238d28f4f56381b1306d8c
Size

258KB
MD5

c4a2b05334238d28f4f56381b1306d8c
SHA1

52eac64d13da8772e7748d4cdb19d6a637ba5e66
SHA256

e59b42ad41431fbfce669a6cc366fbb6e8713ee4dd6fea3bee58c2d92e83eb9c
SHA512

2322f071f6a565b1aaa1e4a6b73d2d5d09bdb3a606c2a15da7ef8dc808c303141a833716f1c5ab82d5af4f542197211fcbc97f9363e0dc87a4d342a718a1ff9c
SSDEEP

6144:iwOnly+xJF29KMzkTQ3JdhcXAQcOZiDrx/zGgpebF+U7GTGgOmz:iHnl3xJFkVhcXAQcOZiDrx/zRp2F+U7E

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c4a2b05334238d28f4f56381b1306d8c

Files

c4a2b05334238d28f4f56381b1306d8c
.dll windows:5 windows x86 arch:x86

e3a57311d4af85350c40fa03a38a10a3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

adsnt.pdb

Imports

msvcrt

_CxxThrowException
free
_initterm
wcsrchr
wcscpy
_adjust_fdiv
__dllonexit
_onexit
_ftol
_wcsnicmp
wcschr
_ltow
_wtol
_itow
wcscmp
_except_handler3
wcslen
wcscat
_purecall
_wcsicmp
malloc

ntdll

RtlRunEncodeUnicodeString
RtlInitUnicodeString
RtlRunDecodeUnicodeString
RtlSecondsSince1970ToTime
RtlTimeToSecondsSince1970

activeds

ord7
ord21
ord22
ord23
ord17
ord18
ord15
ord14
ord16

ole32

CoCreateInstance
CoTaskMemFree
StringFromCLSID
CreatePointerMoniker
StringFromGUID2
CLSIDFromString
IIDFromString

advapi32

LockServiceDatabase
ChangeServiceConfigW
UnlockServiceDatabase
OpenServiceW
QueryServiceConfigW
OpenSCManagerW
CreateServiceW
CloseServiceHandle
QueryServiceStatus
GetSidSubAuthorityCount
GetSidSubAuthority
GetLengthSid
RegConnectRegistryW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
StartServiceW
ControlService
LookupAccountNameW
EnumServicesStatusW
DeleteService
GetUserNameW
SystemFunction040
SystemFunction041
GetSidIdentifierAuthority

winspool.drv

DeletePrinter
GetJobW
EnumPrintersW
OpenPrinterW
SetPrinterW
ClosePrinter
AddPrinterW
GetPrinterW
EnumJobsW
SetJobW

kernel32

CompareStringW
GetTickCount
GetSystemTime
SystemTimeToFileTime
SetLastError
GetLastError
InterlockedIncrement
InterlockedDecrement
LocalFree
LocalAlloc
WaitForSingleObject
ReleaseSemaphore
LoadLibraryW
GetProcAddress
FreeLibrary
DeleteCriticalSection
CreateSemaphoreW
InitializeCriticalSection
DisableThreadLibraryCalls
GetComputerNameW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
LocalFileTimeToFileTime
FileTimeToLocalFileTime
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FormatMessageW
FileTimeToDosDateTime
DosDateTimeToFileTime
GetModuleHandleW
CloseHandle
EnterCriticalSection
LeaveCriticalSection
lstrlenW

user32

wsprintfW
LoadStringW

oleaut32

VariantInit
DispGetIDsOfNames
LoadRegTypeLi
DispInvoke
SetErrorInfo
VariantCopy
SysFreeString
SafeArrayDestroy
SafeArrayPutElement
SafeArrayCreate
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayGetLBound
SysAllocString
SafeArrayUnaccessData
SafeArrayAccessData
CreateErrorInfo
SystemTimeToVariantTime
VariantTimeToSystemTime
DosDateTimeToVariantTime
VariantTimeToDosDateTime
VariantClear

netapi32

NetLocalGroupGetMembers
NetGroupDel
NetLocalGroupDel
NetLocalGroupAdd
NetUserDel
I_NetNameCompare
NetFileEnum
NetGroupGetUsers
NetGetDCName
NetGetAnyDCName
DsRoleFreeMemory
DsRoleGetPrimaryDomainInformation
NetWkstaGetInfo
NetUseGetInfo
NetWkstaUserGetInfo
NetGroupEnum
NetFileGetInfo
NetLocalGroupEnum
NetShareEnum
NetShareDel
NetShareSetInfo
NetShareAdd
NetShareGetInfo
NetSessionDel
NetSessionEnum
NetSessionGetInfo
NetServerSetInfo
NetLocalGroupGetInfo
NetGroupAdd
NetGroupDelUser
NetGroupAddUser
NetLocalGroupAddMembers
NetLocalGroupDelMembers
NetUserGetLocalGroups
NetUserGetGroups
NetGroupGetInfo
NetUserChangePassword
NetUserAdd
NetServerGetInfo
NetLocalGroupSetInfo
NetGroupSetInfo
NetUserGetInfo
NetUserSetInfo
NetQueryDisplayInformation
NetUserModalsGet
NetUserModalsSet
NetApiBufferFree
NetServerEnum

mpr

WNetCancelConnection2W
WNetAddConnection2W

rassapi

ord3
ord2

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 221KB - Virtual size: 221KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e3a57311d4af85350c40fa03a38a10a3

Headers

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

activeds

ole32

advapi32

winspool.drv

kernel32

user32

oleaut32

netapi32

mpr

rassapi

Exports

Exports

Sections

.text Size: 221KB - Virtual size: 221KB

.data Size: 21KB - Virtual size: 21KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 12KB - Virtual size: 11KB

.text
Size: 221KB - Virtual size: 221KB

.data
Size: 21KB - Virtual size: 21KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 12KB - Virtual size: 11KB