c7588f3b3772ae728f5bb8565face342

General

Target

c7588f3b3772ae728f5bb8565face342
Size

13KB
MD5

c7588f3b3772ae728f5bb8565face342
SHA1

381a064b298834920f91185ac3513ef2c6a842b1
SHA256

7624fee0ae27c6886e2679efc13a772a4490e0b38d1167926fbd7c0fab40fe5d
SHA512

39f2b1659d41db7b7bdff536a2dce4bd8146f6cb54ef9ab920c9cae3baa0c9919367e4d25fb5ed6f4419845def206283ea271d6f68fd291dd9b907948491f52a
SSDEEP

384:FgHUJemIeS7WC8iLW74a8WfMptsN0BhgO49:ajQiQzRfMpy0BF4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c7588f3b3772ae728f5bb8565face342

Files

c7588f3b3772ae728f5bb8565face342
.exe windows:5 windows x86 arch:x86

8a027e4d70c5e6579663308bbe142c5c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

lsass.pdb

Imports

advapi32

FreeSid
CheckTokenMembership
AllocateAndInitializeSid
OpenThreadToken
ImpersonateSelf
RevertToSelf

kernel32

CloseHandle
GetCurrentThread
ExitThread
SetUnhandledExceptionFilter
SetErrorMode
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
RtlUnwind
InterlockedExchange
VirtualQuery

ntdll

NtSetInformationProcess
RtlInitUnicodeString
NtCreateEvent
NtOpenEvent
NtSetEvent
NtClose
NtRaiseHardError
RtlAdjustPrivilege
NtShutdownSystem
RtlUnhandledExceptionFilter

lsasrv

LsaISetupWasRun
LsapDsDebugInitialize
LsapAuOpenSam
LsapCheckBootMode
ServiceInit
LsapInitLsa
LsapDsInitializePromoteInterface
LsapDsInitializeDsStateInfo

samsrv

SamIInitialize
SampUsingDsData

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8a027e4d70c5e6579663308bbe142c5c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

ntdll

lsasrv

samsrv

Sections

.text Size: 4KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 108B

.rsrc Size: 7KB - Virtual size: 6KB

.text
Size: 4KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 108B

.rsrc
Size: 7KB - Virtual size: 6KB