6648c5a75ccbeb974e4d2be3f2b06fc1d227290723ac6c96ea42de204505451c

Sharing

Copy URL

Twitter E-mail

General

Target

6648c5a75ccbeb974e4d2be3f2b06fc1d227290723ac6c96ea42de204505451c
Size

161KB
MD5

8af58002573a376804687454f6c51bbc
SHA1

b2141123b2b72e72e5e9443893255944386efbb8
SHA256

6648c5a75ccbeb974e4d2be3f2b06fc1d227290723ac6c96ea42de204505451c
SHA512

772bdfd5bbe321d388fb772e1e11cf2d0a14275ec47513c2e1ea61534993fd5f96ea064444e1d425f38b1ae8822c8e99f383aab15fc05f70ba5b38e41924272a
SSDEEP

3072:tjDb1k1tVWtDvFafgXjzLshpDUJs7ykX22CVeVBaETmzJaaNxzi1:zk1zzUqt2JQkzJaEG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6648c5a75ccbeb974e4d2be3f2b06fc1d227290723ac6c96ea42de204505451c

Files

6648c5a75ccbeb974e4d2be3f2b06fc1d227290723ac6c96ea42de204505451c
.exe windows:5 windows x86 arch:x86

b2458b5d14544acc92761704168ff04b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

DfsSvc.pdb

Imports

msvcrt

_purecall
_wcsicmp
_wcsnicmp
printf
exit
_except_handler3
malloc
wcslen
free
??3@YAXPAX@Z
??2@YAPAXI@Z
_c_exit
_exit
_XcptFilter
_cexit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
__dllonexit
_onexit

advapi32

RegisterEventSourceW
DeregisterEventSource
ReportEventW
RegEnumValueW
LsaQueryForestTrustInformation
DeleteAce
GetAce
AccessCheck
OpenThreadToken
GetTokenInformation
IsValidSecurityDescriptor
MakeSelfRelativeSD
MakeAbsoluteSD
AdjustTokenPrivileges
LookupPrivilegeNameW
OpenProcessToken
MapGenericMask
RegGetKeySecurity
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
SetServiceStatus
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
TraceMessage
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
RegDeleteKeyW
RegEnumKeyExW
RegNotifyChangeKeyValue
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey
RegConnectRegistryW
OpenServiceW
QueryServiceConfigW
ChangeServiceConfigW
ControlService
CloseServiceHandle
LsaOpenPolicy
LsaQueryInformationPolicy
LsaFreeMemory
LsaClose
OpenSCManagerW
RegQueryValueExW

kernel32

GetTickCount
QueryPerformanceCounter
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
SetLastError
LeaveCriticalSection
GetCommandLineW
Sleep
GetLastError
LocalFree
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetStartupInfoA
EnterCriticalSection
SetEvent
WaitForSingleObject
CloseHandle
GetVersionExW
InterlockedCompareExchange
InterlockedDecrement
InterlockedIncrement
GetComputerNameExW
ResetEvent
WaitForMultipleObjects
CreateEventW
ResumeThread
SystemTimeToFileTime
GetSystemTime
CreateThread
GetLocalTime
InterlockedExchange
SetWaitableTimer
CreateWaitableTimerW
GetVolumePathNameW
CreateFileW
GetVolumeNameForVolumeMountPointW
CompareFileTime
InterlockedExchangeAdd
MoveFileW
HeapFree
HeapAlloc
GetProcessHeap
GetCurrentThread
LocalAlloc
HeapCreate
SetUnhandledExceptionFilter

netapi32

NetShareGetInfo
DsEnumerateDomainTrustsW
DsRoleGetPrimaryDomainInformation
DsRoleFreeMemory
NetDfsSetInfo
NetApiBufferFree
DsGetDcNameW
DsGetSiteNameW
I_NetDfsIsThisADomainName
DsAddressToSiteNamesW

activeds

ord3
ord5
ord6
ord4
ord7
ord9

clusapi

GetClusterResourceKey
ClusterRegOpenKey
ClusterRegCloseKey
GetClusterResourceNetworkName
OpenCluster
ClusterControl
CloseCluster
GetNodeClusterState

ntdll

NtQueryInformationFile
NtQueryDirectoryFile
NtFsControlFile
NtClose
NtCreateFile
RtlEqualDomainName
wcscspn
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
RtlFreeUnicodeString
RtlCompareUnicodeString
wcscpy
RtlCopyUnicodeString
RtlInitUnicodeString
RtlAllocateAndInitializeSid
RtlNtStatusToDosError
NtDeleteFile
wcschr
memmove
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
RtlEqualUnicodeString
NtOpenFile
NtQueryVolumeInformationFile
_vsnwprintf
wcscat
NtQuerySystemTime
RtlRandomEx
RtlDosPathNameToNtPathName_U
RtlPrefixUnicodeString
RtlIdentifierAuthoritySid
RtlSubAuthorityCountSid
RtlValidAcl
RtlUpcaseUnicodeChar
RtlAdjustPrivilege

ntdsapi

DsBindW
DsQuerySitesByCostW
DsQuerySitesFree
DsFreeDomainControllerInfoW
DsBindToISTGW
DsBindingSetTimeout
DsUnBindW
DsGetDomainControllerInfoW

ole32

CoInitializeEx
CoUninitialize

oleaut32

VariantInit
SysAllocString
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayGetLBound
VariantClear
SysFreeString

resutils

ResUtilEnumResources
ResUtilGetSzValue
ResUtilGetDwordValue

rpcrt4

RpcServerUseProtseqEpW
RpcServerUnregisterIf
RpcMgmtWaitServerListen
RpcMgmtStopServerListening
UuidToStringW
RpcServerRegisterIf
UuidCreate
RpcRevertToSelf
RpcImpersonateClient
NdrServerCall2
RpcServerListen
RpcStringFreeW

shell32

CommandLineToArgvW

shlwapi

PathAddBackslashW
SHDeleteKeyW
SHCopyKeyW

wldap32

ord142
ord26
ord203
ord79
ord155
ord41
ord12
ord16
ord73
ord14
ord145
ord224
ord140
ord13
ord18

ws2_32

GetNameInfoW
gethostbyname
WSAStartup

Sections

.text
Size: 156KB - Virtual size: 155KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 17B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

b2458b5d14544acc92761704168ff04b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

advapi32

kernel32

netapi32

activeds

clusapi

ntdll

ntdsapi

ole32

oleaut32

resutils

rpcrt4

shell32

shlwapi

wldap32

ws2_32

Sections

.text Size: 156KB - Virtual size: 155KB

.data Size: 2KB - Virtual size: 4KB

.tls Size: 512B - Virtual size: 17B

.rsrc Size: 1KB - Virtual size: 65KB

.text
Size: 156KB - Virtual size: 155KB

.data
Size: 2KB - Virtual size: 4KB

.tls
Size: 512B - Virtual size: 17B

.rsrc
Size: 1KB - Virtual size: 65KB