db22f0ebfdcef292ff805457b607e16719562cfaa6df4ce268e12a960837f9c1

Sharing

Copy URL Twitter E-mail

General

Target

db22f0ebfdcef292ff805457b607e16719562cfaa6df4ce268e12a960837f9c1
Size

72KB
MD5

93ef796dff4bc906d636ae707b6c898f
SHA1

d83a5d080cb1e17a9bf947d52e48d07d54cb29ce
SHA256

db22f0ebfdcef292ff805457b607e16719562cfaa6df4ce268e12a960837f9c1
SHA512

3c90fd5921da8f54c1115757d3c2ea9230de6f1f3d0a6f4a3122e47840ad4285e79de1199687178dc5a8a0eb95d06878de588fd4c1ca320db7b1d9a758d614dd
SSDEEP

1536:5N9Uzl0J6hCMe9bgJ3TpBViZkVoVe52pwzsPtzzK:dH6hCM4bgJVskVos504slK

Score

1^/10

Malware Config

Signatures

Files

db22f0ebfdcef292ff805457b607e16719562cfaa6df4ce268e12a960837f9c1
.dll windows:10 windows x86 arch:x86

78de637967c5dab46e91fe92dd9b62bd

Code Sign

33:00:00:03:8d:b0:bf:e1:b0:ca:33:b3:d4:00:00:00:00:03:8d
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05/05/2022, 19:23

Not After

04/05/2023, 19:23

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

86:11:38:ea:44:6a:73:89:16:c4:2e:15:17:cc:a8:26:5a:42:6e:11:c0:61:29:1c:89:af:79:b9:c1:f8:42:60
Signer

Actual PE Digest

86:11:38:ea:44:6a:73:89:16:c4:2e:15:17:cc:a8:26:5a:42:6e:11:c0:61:29:1c:89:af:79:b9:c1:f8:42:60

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

netapi32.pdb

Imports

msvcrt

_itow_s
_wcsicmp
wcsncpy_s
wcscat_s
wcsspn
wcstoul
qsort
wcschr
wcscpy_s
strcpy_s
memcpy
_except_handler4_common
_initterm
malloc
free
_amsg_exit
_XcptFilter
isdigit
_wcsnicmp
strchr
memset

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
DisableThreadLibraryCalls
GetProcAddress
LoadLibraryExW

api-ms-win-core-synch-l1-1-0

CreateEventW

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegQueryInfoKeyW

api-ms-win-core-heap-l2-1-0

LocalReAlloc
LocalFree
LocalAlloc

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-heap-obsolete-l1-1-0

LocalSize

ntdll

RtlInitUnicodeString
RtlNtStatusToDosError
RtlInitAnsiString
RtlOemStringToUnicodeString
RtlUnicodeToOemN
RtlxUnicodeStringToOemSize
NtImpersonateAnonymousToken
NtCreateFile
NtFsControlFile
NtClose
NtSetInformationThread
NtOpenThreadToken
RtlEqualSid
RtlEqualUnicodeString
RtlAllocateHeap
RtlFreeHeap
RtlCompareUnicodeString
RtlLengthSid

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation

Exports

Exports

DavAddConnection
DavDeleteConnection
DavFlushFile
DavGetExtendedError
DavGetHTTPFromUNCPath
DavGetUNCFromHTTPPath
DsAddressToSiteNamesA
DsAddressToSiteNamesExA
DsAddressToSiteNamesExW
DsAddressToSiteNamesW
DsDeregisterDnsHostRecordsA
DsDeregisterDnsHostRecordsW
DsEnumerateDomainTrustsA
DsEnumerateDomainTrustsW
DsGetDcCloseW
DsGetDcNameA
DsGetDcNameW
DsGetDcNameWithAccountA
DsGetDcNameWithAccountW
DsGetDcNextA
DsGetDcNextW
DsGetDcOpenA
DsGetDcOpenW
DsGetDcSiteCoverageA
DsGetDcSiteCoverageW
DsGetForestTrustInformationW
DsGetSiteNameA
DsGetSiteNameW
DsMergeForestTrustInformationW
DsRoleFreeMemory
DsRoleGetPrimaryDomainInformation
DsValidateSubnetNameA
DsValidateSubnetNameW
I_BrowserSetNetlogonState
I_DsUpdateReadOnlyServerDnsRecords
I_NetAccountDeltas
I_NetAccountSync
I_NetChainSetClientAttributes
I_NetChainSetClientAttributes2
I_NetDatabaseDeltas
I_NetDatabaseRedo
I_NetDatabaseSync
I_NetDatabaseSync2
I_NetDfsGetVersion
I_NetDfsIsThisADomainName
I_NetGetDCList
I_NetGetForestTrustInformation
I_NetLogonControl
I_NetLogonControl2
I_NetLogonGetDomainInfo
I_NetLogonSamLogoff
I_NetLogonSamLogon
I_NetLogonSamLogonEx
I_NetLogonSamLogonWithFlags
I_NetLogonSendToSam
I_NetLogonUasLogoff
I_NetLogonUasLogon
I_NetServerAuthenticate
I_NetServerAuthenticate2
I_NetServerAuthenticate3
I_NetServerGetTrustInfo
I_NetServerPasswordGet
I_NetServerPasswordSet
I_NetServerPasswordSet2
I_NetServerReqChallenge
I_NetServerSetServiceBits
I_NetServerSetServiceBitsEx
I_NetServerTrustPasswordsGet
I_NetlogonComputeClientDigest
I_NetlogonComputeServerDigest
NetAccessAdd
NetAccessDel
NetAccessEnum
NetAccessGetInfo
NetAccessGetUserPerms
NetAccessSetInfo
NetAddAlternateComputerName
NetAddServiceAccount
NetAlertRaise
NetAlertRaiseEx
NetApiBufferAllocate
NetApiBufferFree
NetApiBufferReallocate
NetApiBufferSize
NetAuditClear
NetAuditRead
NetAuditWrite
NetConfigGet
NetConfigGetAll
NetConfigSet
NetConnectionEnum
NetCreateProvisioningPackage
NetDfsAdd
NetDfsAddFtRoot
NetDfsAddRootTarget
NetDfsAddStdRoot
NetDfsAddStdRootForced
NetDfsEnum
NetDfsGetClientInfo
NetDfsGetDcAddress
NetDfsGetFtContainerSecurity
NetDfsGetInfo
NetDfsGetSecurity
NetDfsGetStdContainerSecurity
NetDfsGetSupportedNamespaceVersion
NetDfsManagerGetConfigInfo
NetDfsManagerInitialize
NetDfsManagerSendSiteInfo
NetDfsMove
NetDfsRemove
NetDfsRemoveFtRoot
NetDfsRemoveFtRootForced
NetDfsRemoveRootTarget
NetDfsRemoveStdRoot
NetDfsRename
NetDfsSetClientInfo
NetDfsSetFtContainerSecurity
NetDfsSetInfo
NetDfsSetSecurity
NetDfsSetStdContainerSecurity
NetEnumerateComputerNames
NetEnumerateServiceAccounts
NetEnumerateTrustedDomains
NetErrorLogClear
NetErrorLogRead
NetErrorLogWrite
NetFileClose
NetFileEnum
NetFileGetInfo
NetFreeAadJoinInformation
NetGetAadJoinInformation
NetGetAnyDCName
NetGetDCName
NetGetDisplayInformationIndex
NetGetJoinInformation
NetGetJoinableOUs
NetGroupAdd
NetGroupAddUser
NetGroupDel
NetGroupDelUser
NetGroupEnum
NetGroupGetInfo
NetGroupGetUsers
NetGroupSetInfo
NetGroupSetUsers
NetIsServiceAccount
NetJoinDomain
NetLocalGroupAdd
NetLocalGroupAddMember
NetLocalGroupAddMembers
NetLocalGroupDel
NetLocalGroupDelMember
NetLocalGroupDelMembers
NetLocalGroupEnum
NetLocalGroupGetInfo
NetLocalGroupGetMembers
NetLocalGroupSetInfo
NetLocalGroupSetMembers
NetLogonGetTimeServiceParentDomain
NetLogonSetServiceBits
NetMessageBufferSend
NetMessageNameAdd
NetMessageNameDel
NetMessageNameEnum
NetMessageNameGetInfo
NetProvisionComputerAccount
NetQueryDisplayInformation
NetQueryServiceAccount
NetRegisterDomainNameChangeNotification
NetRemoteComputerSupports
NetRemoteTOD
NetRemoveAlternateComputerName
NetRemoveServiceAccount
NetRenameMachineInDomain
NetReplExportDirAdd
NetReplExportDirDel
NetReplExportDirEnum
NetReplExportDirGetInfo
NetReplExportDirLock
NetReplExportDirSetInfo
NetReplExportDirUnlock
NetReplGetInfo
NetReplImportDirAdd
NetReplImportDirDel
NetReplImportDirEnum
NetReplImportDirGetInfo
NetReplImportDirLock
NetReplImportDirUnlock
NetReplSetInfo
NetRequestOfflineDomainJoin
NetRequestProvisioningPackageInstall
NetScheduleJobAdd
NetScheduleJobDel
NetScheduleJobEnum
NetScheduleJobGetInfo
NetServerAliasAdd
NetServerAliasDel
NetServerAliasEnum
NetServerComputerNameAdd
NetServerComputerNameDel
NetServerDiskEnum
NetServerEnum
NetServerEnumEx
NetServerGetInfo
NetServerSetInfo
NetServerTransportAdd
NetServerTransportAddEx
NetServerTransportDel
NetServerTransportEnum
NetServiceControl
NetServiceEnum
NetServiceGetInfo
NetServiceInstall
NetSessionDel
NetSessionEnum
NetSessionGetInfo
NetSetPrimaryComputerName
NetShareAdd
NetShareCheck
NetShareDel
NetShareDelEx
NetShareDelSticky
NetShareEnum
NetShareEnumSticky
NetShareGetInfo
NetShareSetInfo
NetStatisticsGet
NetUnjoinDomain
NetUnregisterDomainNameChangeNotification
NetUseAdd
NetUseDel
NetUseEnum
NetUseGetInfo
NetUserAdd
NetUserChangePassword
NetUserDel
NetUserEnum
NetUserGetGroups
NetUserGetInfo
NetUserGetLocalGroups
NetUserModalsGet
NetUserModalsSet
NetUserSetGroups
NetUserSetInfo
NetValidateName
NetValidatePasswordPolicy
NetValidatePasswordPolicyFree
NetWkstaGetInfo
NetWkstaSetInfo
NetWkstaTransportAdd
NetWkstaTransportDel
NetWkstaTransportEnum
NetWkstaUserEnum
NetWkstaUserGetInfo
NetWkstaUserSetInfo
NetapipBufferAllocate
Netbios
NetpAddTlnFtinfoEntry
NetpAllocFtinfoEntry
NetpAssertFailed
NetpCleanFtinfoContext
NetpCloseConfigData
NetpCopyFtinfoContext
NetpDbgPrint
NetpGetConfigBool
NetpGetConfigDword
NetpGetConfigTStrArray
NetpGetConfigValue
NetpGetFileSecurity
NetpHexDump
NetpInitFtinfoContext
NetpIsRemote
NetpIsUncComputerNameValid
NetpMergeFtinfo
NetpNetBiosReset
NetpNetBiosStatusToApiStatus
NetpOpenConfigData
NetpSetFileSecurity
NetpwNameCanonicalize
NetpwNameCompare
NetpwNameValidate
NetpwPathCanonicalize
NetpwPathCompare
NetpwPathType
NlBindingAddServerToCache
NlBindingRemoveServerFromCache
NlBindingSetAuthInfo
RxNetAccessAdd
RxNetAccessDel
RxNetAccessEnum
RxNetAccessGetInfo
RxNetAccessGetUserPerms
RxNetAccessSetInfo
RxNetServerEnum
RxNetUserPasswordSet
RxRemoteApi

Sections

.text
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

78de637967c5dab46e91fe92dd9b62bd

Code Sign

33:00:00:03:8d:b0:bf:e1:b0:ca:33:b3:d4:00:00:00:00:03:8dCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

86:11:38:ea:44:6a:73:89:16:c4:2e:15:17:cc:a8:26:5a:42:6e:11:c0:61:29:1c:89:af:79:b9:c1:f8:42:60Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

ntdll

api-ms-win-core-timezone-l1-1-0

Exports

Exports

Sections

.text Size: 54KB - Virtual size: 54KB

.data Size: 512B - Virtual size: 912B

.idata Size: 3KB - Virtual size: 2KB

.didat Size: 512B - Virtual size: 108B

.rsrc Size: 1024B - Virtual size: 1016B

.reloc Size: 1KB - Virtual size: 1KB

33:00:00:03:8d:b0:bf:e1:b0:ca:33:b3:d4:00:00:00:00:03:8d
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

86:11:38:ea:44:6a:73:89:16:c4:2e:15:17:cc:a8:26:5a:42:6e:11:c0:61:29:1c:89:af:79:b9:c1:f8:42:60
Signer

.text
Size: 54KB - Virtual size: 54KB

.data
Size: 512B - Virtual size: 912B

.idata
Size: 3KB - Virtual size: 2KB

.didat
Size: 512B - Virtual size: 108B

.rsrc
Size: 1024B - Virtual size: 1016B

.reloc
Size: 1KB - Virtual size: 1KB