a4801000001ad69fde725e9f4101f69b7311fc2cbbdc160631dce5e18820f7ac

Sharing

Copy URL Twitter E-mail

General

Target

a4801000001ad69fde725e9f4101f69b7311fc2cbbdc160631dce5e18820f7ac
Size

315KB
MD5

d69626617c2fd1d4409e40668396766b
SHA1

7834e454f85174e2b4ccd2a79a5edcdd09e363ec
SHA256

a4801000001ad69fde725e9f4101f69b7311fc2cbbdc160631dce5e18820f7ac
SHA512

9f4302b3c90e3750b6580b6660dbbedd50ac83a505b25cc203aac64d2081a5125231c0975e016d810546e4c8474f52e6bd58694867e8ac852b39f3944cad4dde
SSDEEP

6144:skQ8bok7DBuS9qEaeBJ/RnLPxkVKo5O/D+49N:sk7lDUSHaynLz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a4801000001ad69fde725e9f4101f69b7311fc2cbbdc160631dce5e18820f7ac

Files

a4801000001ad69fde725e9f4101f69b7311fc2cbbdc160631dce5e18820f7ac
.dll windows:5 windows x64 arch:x64

5edd923da89836eb7b026c1d0223f6ff

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\FB30\B3_0_Release\Prod_R3_0_3\firebird3\temp\x64\Release\legacy_usermanager\legacy_usermanager.pdb

Imports

kernel32

DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
DisableThreadLibraryCalls
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
Sleep
DecodePointer
EncodePointer
GetTempPathA
WriteFile
ReadFile
SetFilePointer
MultiByteToWideChar
GetDriveTypeA
GetFullPathNameA
WideCharToMultiByte
GetComputerNameA
GetCurrentProcessId
OpenProcess
WaitForSingleObject
SetEvent
ReleaseSemaphore
CreateSemaphoreA
CreateEventA
GetFileInformationByHandle
SetConsoleCtrlHandler
GetFileAttributesA
CreateDirectoryA
GetVolumeInformationA
CreateFileA
GetSystemTime
SystemTimeToFileTime
SetFileTime
FindNextFileA
FindFirstFileA
FindClose
GetVersion
LoadLibraryA
GetProcAddress
CloseHandle
GetModuleFileNameA
lstrcmpA
lstrlenA
GetCurrentProcess
GetProcessTimes
QueryPerformanceFrequency
QueryPerformanceCounter
GetConsoleMode
SetConsoleMode
LocalFree
LocalAlloc
FreeLibrary
GetEnvironmentVariableA
TlsAlloc
VirtualFree
VirtualAlloc
TlsFree
TlsSetValue
TlsGetValue
GetLastError
GetSystemInfo

ws2_32

WSASetLastError
WSAEnumProtocolsA

fbclient

ord42
ord138
ord162
ord168
ord103
fb_get_master_interface
ord186
ord116
ord176
ord166
ord156
ord158
ord128
ord160
ord115
ord1
ord51
ord169
ord37
ord248
fb_interpret
ord249
ord250

msvcr100

__clean_type_info_names_internal
__crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
?terminate@@YAXXZ
_vsnprintf
_onexit
_lock
__dllonexit
_unlock
__CppXcptFilter
__C_specific_handler
_amsg_exit
_encoded_null
free
_initterm_e
_initterm
_malloc_crt
_ftime64
getenv
_stat64i32
strerror
fopen
?_open@@YAHPEBDHH@Z
_mkdir
_errno
_access
qsort
feof
atoi
strstr
memchr
ferror
exit
__iob_func
fprintf
fflush
_get_osfhandle
fclose
_getcwd
strncmp
strchr
??0exception@std@@QEAA@AEBV01@@Z
??1exception@std@@UEAA@XZ
?what@exception@std@@UEBAPEBDXZ
??0exception@std@@QEAA@AEBQEBDH@Z
getc
toupper
memcmp
memmove
isprint
_purecall
_CxxThrowException
strncpy
memset
memcpy
__CxxFrameHandler3
_open
_isatty
_fileno
_strnicmp
_stricmp
_unlink

mpr

WNetCloseEnum
WNetEnumResourceA
WNetOpenEnumA
WNetGetUniversalNameA

user32

CharLowerBuffA
CharUpperBuffA
MessageBoxA

advapi32

CryptAcquireContextA
RegQueryValueExA
RegCloseKey
FreeSid
SetNamedSecurityInfoA
GetUserNameA
GetSecurityInfo
SetSecurityInfo
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegOpenKeyExA
CryptGenRandom
CryptReleaseContext
GetNamedSecurityInfoA
AllocateAndInitializeSid
SetEntriesInAclA

ole32

CoCreateGuid

Exports

Exports

firebird_plugin

Sections

.text
Size: 209KB - Virtual size: 209KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5edd923da89836eb7b026c1d0223f6ff

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

ws2_32

fbclient

msvcr100

mpr

user32

advapi32

ole32

Exports

Exports

Sections

.text Size: 209KB - Virtual size: 209KB

.rdata Size: 81KB - Virtual size: 81KB

.data Size: 1024B - Virtual size: 18KB

.pdata Size: 19KB - Virtual size: 18KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 209KB - Virtual size: 209KB

.rdata
Size: 81KB - Virtual size: 81KB

.data
Size: 1024B - Virtual size: 18KB

.pdata
Size: 19KB - Virtual size: 18KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB