e8cfb266f63a5985d07fdc1521f83870N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

e8cfb266f63a5985d07fdc1521f83870N.exe
Size

1.5MB
MD5

e8cfb266f63a5985d07fdc1521f83870
SHA1

7da651fcf27592639204f9598a626df1c9ad319b
SHA256

fd39052f6acf4578b1eff1b3f0943e86d1683ab58fcf47f7d58b2da6d93d62ae
SHA512

32fd94268604934df7cfe58dbacc4323637870292165ea5d652860367b90bec3e3fbc9ace69bf16f998f72338a1dc94cea4f1b7d32ffe1a2b4fd4f1ad48f2922
SSDEEP

24576:TJtP/PF0dC1Iy7fPbWztNYeajYNqZeoYVaS9nR5:TJtPFxbDWztNqZe38S5R5

Score

1^/10

Malware Config

Signatures

Files

e8cfb266f63a5985d07fdc1521f83870N.exe
.dll regsvr32 windows:10 windows x86 arch:x86

c0efa317fb2c349ca71a94dbf377a2de

Code Sign

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

69:48:94:0b:15:a9:b9:86:5a:dc:91:68:f9:69:1b:2f:00:dd:05:64:f2:b5:1f:51:b8:4a:3a:76:d7:05:c7:71
Signer

Actual PE Digest

69:48:94:0b:15:a9:b9:86:5a:dc:91:68:f9:69:1b:2f:00:dd:05:64:f2:b5:1f:51:b8:4a:3a:76:d7:05:c7:71

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

wsp_fs.pdb

Imports

ntdll

RtlRemoveVectoredExceptionHandler
RtlUnwind
NtQuerySystemInformation
RtlIpv4StringToAddressExW
RtlIpv6StringToAddressExW
RtlNtStatusToDosError
RtlEnumerateGenericTableAvl
RtlEnumerateGenericTableWithoutSplayingAvl
RtlInsertElementGenericTableAvl
RtlLookupElementGenericTableAvl
RtlDeleteElementGenericTableAvl
RtlInitializeGenericTableAvl

api-ms-win-core-sysinfo-l1-1-0

GetComputerNameExW
GetTickCount64
GetSystemDirectoryW
GetSystemTimeAsFileTime

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetLastError
GetLastError
SetUnhandledExceptionFilter
RaiseException

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
DisableThreadLibraryCalls
GetProcAddress
LoadStringW
GetModuleHandleW
GetModuleFileNameA
LoadLibraryExW
GetModuleFileNameW
FreeLibrary

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl
EventWriteTransfer
EventSetInformation
EventUnregister
EventRegister

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-processthreads-l1-1-0

TlsGetValue
GetStartupInfoW
TlsSetValue
TlsFree
ExitProcess
GetCurrentProcess
GetCurrentThread
GetCurrentProcessId
SetThreadToken
OpenProcessToken
OpenThreadToken
TlsAlloc
GetCurrentThreadId
TerminateProcess

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapReAlloc
HeapSize
HeapAlloc

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
ReleaseSRWLockShared
InitializeCriticalSection
CreateEventW
SetEvent
ResetEvent
ReleaseSemaphore
ReleaseMutex
WaitForSingleObjectEx
WaitForSingleObject
OpenSemaphoreW
CreateMutexExW
CreateSemaphoreExW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
AcquireSRWLockShared
EnterCriticalSection
InitializeCriticalSectionEx

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentStringsW
GetCommandLineW
GetEnvironmentVariableW
SetStdHandle
FreeEnvironmentStringsW
GetStdHandle
GetCommandLineA

api-ms-win-core-file-l1-1-0

RemoveDirectoryW
GetFileAttributesW
GetVolumePathNameW
FindVolumeClose
GetFileType
SetFilePointerEx
CreateDirectoryW
FindFirstFileW
GetDiskFreeSpaceExW
FindNextVolumeW
FindFirstVolumeW
FindNextFileW
FindFirstFileExW
FindClose
WriteFile
GetDriveTypeW
GetVolumeInformationW
FlushFileBuffers
CreateFileW

api-ms-win-core-string-l1-1-0

GetStringTypeW
WideCharToMultiByte
CompareStringOrdinal
CompareStringEx
MultiByteToWideChar
CompareStringW

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW
FormatMessageA
LCMapStringEx
GetACP
GetOEMCP
LCMapStringW
GetCPInfo
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FormatMessageW
IsValidCodePage

api-ms-win-core-console-l1-1-0

GetConsoleOutputCP
GetConsoleMode
WriteConsoleW

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList

api-ms-win-core-fibers-l1-1-0

FlsFree
FlsAlloc
FlsGetValue
FlsSetValue

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-security-base-l1-1-0

DeleteAce
IsValidSid
ImpersonateLoggedOnUser
DuplicateTokenEx
AddAccessAllowedAceEx
EqualSid
CopySid
AddAccessDeniedAceEx
IsValidAcl
MakeAbsoluteSD
GetAclInformation
GetAce
GetTokenInformation
AddAce
GetLengthSid
InitializeAcl
FreeSid

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW
ConvertStringSidToSidW

api-ms-win-security-lsalookup-l2-1-0

LookupAccountNameW
LookupAccountSidW

api-ms-win-security-provider-l1-1-0

GetSecurityInfo
SetNamedSecurityInfoW
GetNamedSecurityInfoW

netapi32

NetApiBufferFree
DsGetDcNameW

clusapi

ClusterOpenEnumEx
CloseClusterNetInterface
MoveClusterGroup
CloseCluster
DestroyCluster
CloseClusterNetwork
CloseClusterResource
CloseClusterGroup
GetClusterFromResource
GetClusterNodeKey
OpenClusterNode
ClusterGetEnumCount
ClusterCloseEnum
OpenClusterResource
ClusterEnum
ClusterOpenEnum
OpenCluster
ClusterRegCloseKey
GetClusterResourceKey
GetClusterKey
ClusterRegSetValue
ClusterRegQueryValue
GetClusterNotifyV2
RegisterClusterResourceTypeNotifyV2
CreateClusterNotifyPortV2
CCHlpCreateClusterNameInAD
CCHlpConfigureNode
CreateCluster
CCHlpGetDNSHostLabel
GetNodeClusterState
DeleteClusterResourceType
ClusterResourceTypeControl
GetClusterNetInterfaceState
ClusterNetInterfaceControl
OpenClusterNetInterfaceEx
GetClusterNetworkState
ClusterNetworkControl
SetClusterNetworkName
OpenClusterNetworkEx
EvictClusterNodeEx
ResumeClusterNodeEx
PauseClusterNodeEx
GetClusterNodeState
ClusterNodeControl
OpenClusterNodeEx
CreateClusterResource
SetClusterGroupNodeList
SetClusterGroupName
CancelClusterGroupOperation
MoveClusterGroupEx
OnlineClusterGroupEx
OfflineClusterGroupEx
DeleteClusterGroup
DestroyClusterGroup
GetClusterGroupState
ClusterGroupControl
OpenClusterGroupEx
RemoveClusterResourceNode
AddClusterResourceNode
FailClusterResource
RestartClusterResource
SetClusterResourceDependencyExpression
GetClusterResourceDependencyExpression
RemoveClusterResourceDependency
AddClusterResourceDependency
ChangeClusterResourceGroup
OnlineClusterResourceEx
OfflineClusterResourceEx
DeleteClusterResource
GetClusterResourceState
SetClusterResourceName
ClusterResourceControl
OpenClusterResourceEx
ClusterUpgradeFunctionalLevel
CCHlpAddNodeUpdateCluster
CCHlpGetClusterServiceSecret
ClusterEnumEx
CreateClusterResourceType
CreateClusterGroupEx
SetClusterName
SetClusterQuorumResource
RemoveResourceFromClusterSharedVolumes
AddResourceToClusterSharedVolumes
ClusterControl
GetClusterQuorumResource
GetClusterInformation
AddClusterNode
OpenClusterEx
CloseClusterNotifyPort
ClusterNetworkCloseEnum
ClusterResourceTypeCloseEnum
ClusterResourceCloseEnum
ClusterGroupCloseEnum
ClusterCloseEnumEx
ClusterNodeCloseEnumEx
ClusterGroupCloseEnumEx
ClusterResourceCloseEnumEx
ClusterResourceGetEnumCountEx
ClusterResourceEnumEx
ClusterResourceOpenEnumEx
ClusterGroupGetEnumCountEx
ClusterGroupEnumEx
ClusterGroupOpenEnumEx
ClusterGroupGetEnumCount
ClusterGroupEnum
ClusterGroupOpenEnum
ClusterNetworkGetEnumCount
ClusterNetworkEnum
ClusterNetworkOpenEnum
ClusterResourceGetEnumCount
ClusterResourceEnum
ClusterResourceOpenEnum
ClusterResourceTypeGetEnumCount
ClusterResourceTypeEnum
ClusterResourceTypeOpenEnum
ClusterNodeGetEnumCountEx
ClusterNodeEnumEx
ClusterNodeOpenEnumEx
ClusterGetEnumCountEx
CloseClusterNode

mispace

WspProviderEnter
WspProviderExit
WspIsRemoteInstance
WspGetRemoteInstance
WspInvokeRemoteMethod
WspReferencesOfRemoteInstance
WspGetSubsystemFilter
WspFreeString
WspPackObjectId
WspUnpackObjectId
WspEnumerateRemoteInstances

ws2_32

GetAddrInfoW
htons
WSAGetLastError
WSAAddressToStringW
FreeAddrInfoW
WSAStringToAddressW

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
InitOnceInitialize
Sleep

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoUninitialize
CoCreateInstanceEx
CoInitializeEx

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
CreateThreadpoolTimer
CreateThreadpoolWork
CloseThreadpoolWork
CreateThreadpoolCleanupGroup
CloseThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
WaitForThreadpoolWorkCallbacks
SubmitThreadpoolWork

crypt32

CryptProtectMemory
CryptUnprotectMemory

dsrole

DsRoleFreeMemory
DsRoleGetPrimaryDomainInformation

api-ms-win-core-file-l1-2-0

GetVolumeNameForVolumeMountPointW
GetVolumePathNamesForVolumeNameW

iphlpapi

IcmpCreateFile
IcmpSendEcho
Icmp6SendEcho2
IcmpCloseHandle
Icmp6CreateFile

oleaut32

SysFreeString
SysAllocString

dnsapi

DnsFlushResolverCacheEntry_W

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueEx

api-ms-win-core-heap-obsolete-l1-1-0

LocalSize

cryptsp

CryptReleaseContext
CryptAcquireContextW
CryptGenRandom

sscore

SsCoreUninitialize

ntdsapi

DsUnBindW
DsBindWithCredW

mi

mi_clientFT_V1
MI_Application_InitializeV1

wldap32

ord140
ord13
ord97
ord224
ord14
ord18
ord88
ord73
ord79
ord41
ord26
ord142
ord145
ord203

api-ms-win-security-activedirectoryclient-l1-1-0

DsCrackNamesW
DsFreeNameResultW
DsFreePasswordCredentials

resutils

ResUtilGetResourceName

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
GetProviderClassID
MI_Main
PreShutdown
SetShutdownCallback
SmpUnload

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 85KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 100KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c0efa317fb2c349ca71a94dbf377a2de

Code Sign

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

69:48:94:0b:15:a9:b9:86:5a:dc:91:68:f9:69:1b:2f:00:dd:05:64:f2:b5:1f:51:b8:4a:3a:76:d7:05:c7:71Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntdll

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-heap-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-heap-l2-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-security-provider-l1-1-0

netapi32

clusapi

mispace

ws2_32

api-ms-win-core-synch-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-threadpool-l1-2-0

crypt32

dsrole

api-ms-win-core-file-l1-2-0

iphlpapi

oleaut32

dnsapi

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

cryptsp

sscore

ntdsapi

mi

wldap32

api-ms-win-security-activedirectoryclient-l1-1-0

resutils

Exports

Exports

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.data Size: 85KB - Virtual size: 90KB

.idata Size: 13KB - Virtual size: 13KB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 100KB - Virtual size: 100KB

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

69:48:94:0b:15:a9:b9:86:5a:dc:91:68:f9:69:1b:2f:00:dd:05:64:f2:b5:1f:51:b8:4a:3a:76:d7:05:c7:71
Signer

.text
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 85KB - Virtual size: 90KB

.idata
Size: 13KB - Virtual size: 13KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 100KB - Virtual size: 100KB