d317354fdf57fe1bfc99206b22f923cad977acd24580c580bac9aaaf2f257902

Sharing

Copy URL Twitter E-mail

General

Target

d317354fdf57fe1bfc99206b22f923cad977acd24580c580bac9aaaf2f257902
Size

320KB
MD5

c06d08d6ca5ba016251ca80b3ed39550
SHA1

381fe63acd7ac963c115d3eb55648c3a91233c5a
SHA256

d317354fdf57fe1bfc99206b22f923cad977acd24580c580bac9aaaf2f257902
SHA512

19af4ecddcad851ff5897fcd38f0857996311706838b635b538d0e414c9e478006bb4694ba9683f663b24c4dd10f47340084c5e3b877c41e474c772eb03546df
SSDEEP

6144:6D4eThiLMG8TcUg7EsUc9IbKjYzNZBV+UdvrEFp7hKqoO:6bpG8TcFx9IejYPBjvrEH71oO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d317354fdf57fe1bfc99206b22f923cad977acd24580c580bac9aaaf2f257902

Files

d317354fdf57fe1bfc99206b22f923cad977acd24580c580bac9aaaf2f257902
.dll windows:4 windows x86 arch:x86

bde155524390b733d82a92d9c49b8a7c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Project\DoAsAdmin\2010_06\review済み\DoAsAdminTools\release\DatAccess.pdb

Imports

kernel32

GetCurrentDirectoryA
GetCPInfo
GetOEMCP
HeapAlloc
GetSystemTimeAsFileTime
HeapFree
VirtualAlloc
HeapReAlloc
GetCommandLineA
GetProcessHeap
RtlUnwind
RaiseException
ExitProcess
HeapSize
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
VirtualFree
HeapDestroy
HeapCreate
GetStdHandle
GetDriveTypeA
Sleep
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetACP
IsValidCodePage
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
SetStdHandle
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
WritePrivateProfileStringA
InterlockedIncrement
GetFileTime
GetFileAttributesA
FileTimeToLocalFileTime
GlobalFlags
GlobalFindAtomA
lstrcmpW
GetVersionExA
FileTimeToSystemTime
GlobalGetAtomNameA
SetErrorMode
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
GlobalAddAtomA
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
lstrcmpA
GetCurrentProcessId
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageA
LocalFree
CreateFileA
GetFullPathNameA
GetVolumeInformationA
GetCurrentProcess
DuplicateHandle
CloseHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
LoadLibraryA
GetThreadLocale
MoveFileA
FreeLibrary
InterlockedDecrement
GetModuleFileNameW
SetLastError
GetProcAddress
MultiByteToWideChar
InterlockedExchange
CompareStringW
GetVersion
CompareStringA
FindResourceA
CreateProcessA
LoadResource
SetFileAttributesA
LockResource
SizeofResource
CopyFileA
WideCharToMultiByte
GetModuleHandleA
GetModuleFileNameA
lstrcatA
lstrcpyA
lstrcmpiA
FindClose
FindFirstFileA
GetExitCodeProcess
lstrlenA
SetHandleCount
GetLastError

user32

GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
LoadCursorA
GetDC
ReleaseDC
GetSysColorBrush
ClientToScreen
ShowWindow
SetWindowTextA
RegisterWindowMessageA
LoadIconA
WinHelpA
GetCapture
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
IsWindow
GetForegroundWindow
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetForegroundWindow
GetClientRect
GetMenu
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
AdjustWindowRectEx
CopyRect
PtInRect
PeekMessageA
CharUpperA
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
SetWindowLongA
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetWindow
GetWindowTextA
UnregisterClassA
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
IsWindowVisible
DestroyMenu
CheckMenuItem
EnableMenuItem
GetMenuState
ModifyMenuA
SendMessageA
GetParent
GetFocus
LoadBitmapA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
UnhookWindowsHookEx
GetSystemMetrics
GetSubMenu
GetMenuItemCount
GetMenuItemID
GetKeyState
GetCursorPos
ValidateRect
SetCursor
PostMessageA
PostQuitMessage
GetWindowThreadProcessId
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
EnableWindow
MessageBoxA

gdi32

GetStockObject
DeleteDC
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
CreateBitmap
SetMapMode
RestoreDC
SaveDC
DeleteObject
SetBkColor
SetTextColor
GetClipBox
GetDeviceCaps

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
ClosePrinter
DocumentPropertiesA

advapi32

RegSetValueExA
RegCreateKeyExA
RegQueryValueA
RegEnumKeyA
RegDeleteKeyA
RegOpenKeyExA
RegOpenKeyA
RegCloseKey
RegQueryValueExA
CryptGetHashParam
CryptDestroyKey
CryptDestroyHash
CryptDecrypt
CryptEncrypt
CryptSetKeyParam
CryptDeriveKey
CryptHashData
CryptCreateHash
CryptAcquireContextA

shlwapi

PathStripToRootA
PathIsUNCA
PathFindExtensionA
PathFindFileNameA

oleaut32

VariantClear
VariantChangeType
VariantInit

Exports

Exports

??0CDatAccess@@QAE@HH@Z
??1CDatAccess@@QAE@XZ
??4CDatAccess@@QAEAAV0@ABV0@@Z
??_FCDatAccess@@QAEXXZ
?DllCopy_WithExpand@CDatAccess@@AAEHPBD0H@Z
?DllIs_ExistFile@CDatAccess@@AAEHPBD@Z
?DllMake_PracticeEnv@CDatAccess@@AAEHPBD0@Z
?DllRead_ParamFile@CDatAccess@@AAEHPBD@Z
?DllSplit_FullPath@CDatAccess@@AAEXPBDPAD1@Z
?DllWrite_CheckCode@CDatAccess@@AAEHPAVCFile@@PAVCrypto@@H@Z
?DllWrite_Domain@CDatAccess@@AAEHPAVCFile@@PAVCrypto@@H@Z
?DllWrite_ExeOption@CDatAccess@@AAEHPAVCFile@@PAVCrypto@@H@Z
?DllWrite_ExeRelativePath@CDatAccess@@AAEHPAVCFile@@PAVCrypto@@H@Z
?DllWrite_Impersonation@CDatAccess@@AAEHPAVCFile@@PAVCrypto@@H@Z
?DllWrite_Password@CDatAccess@@AAEHPAVCFile@@PAVCrypto@@H@Z
?DllWrite_RanPassword@CDatAccess@@AAEHPAVCFile@@PAVCrypto@@H@Z
?DllWrite_Silent@CDatAccess@@AAEHPAVCFile@@PAVCrypto@@H@Z
?DllWrite_UserName@CDatAccess@@AAEHPAVCFile@@PAVCrypto@@H@Z
?GetCheckCode@CDatAccess@@QAEXPAE@Z
?GetCryptLastError@CDatAccess@@QAEKXZ
?GetCurrentCheckCode@CDatAccess@@QAEHPBDPAE@Z
?GetDomain@CDatAccess@@QAEXPAD@Z
?GetExeOption@CDatAccess@@QAEXPAD@Z
?GetExeRelativePath@CDatAccess@@QAEXPAD@Z
?GetImpersonation@CDatAccess@@QAEHXZ
?GetPassword@CDatAccess@@QAEXPAD@Z
?GetSilent@CDatAccess@@QAEHXZ
?GetUserNameA@CDatAccess@@QAEXPAD@Z
?MakePracticeEnv@CDatAccess@@QAEHPBD0@Z
?ReadParamFile@CDatAccess@@QAEHPBD@Z
?SetCheckCode@CDatAccess@@QAEXPAE@Z
?SetDomain@CDatAccess@@QAEXPBD@Z
?SetExeOption@CDatAccess@@QAEXPBD@Z
?SetExeRelativePath@CDatAccess@@QAEXPBD@Z
?SetImpersonation@CDatAccess@@QAEXH@Z
?SetPassword@CDatAccess@@QAEXPBD@Z
?SetSilent@CDatAccess@@QAEXH@Z
?SetUserName@CDatAccess@@QAEXPBD@Z
?WriteParamFile@CDatAccess@@QAEHPBD0@Z

Sections

.text
Size: 156KB - Virtual size: 153KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bde155524390b733d82a92d9c49b8a7c

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shlwapi

oleaut32

Exports

Exports

Sections

.text Size: 156KB - Virtual size: 153KB

.rdata Size: 36KB - Virtual size: 32KB

.data Size: 8KB - Virtual size: 22KB

.rsrc Size: 20KB - Virtual size: 17KB

.reloc Size: 20KB - Virtual size: 19KB

.text
Size: 156KB - Virtual size: 153KB

.rdata
Size: 36KB - Virtual size: 32KB

.data
Size: 8KB - Virtual size: 22KB

.rsrc
Size: 20KB - Virtual size: 17KB

.reloc
Size: 20KB - Virtual size: 19KB