56b8d8c7de0b810d33ff6d1ba9daa421de144515c92e5f207bb5c567985e6d8a

Sharing

Copy URL Twitter E-mail

General

Target

56b8d8c7de0b810d33ff6d1ba9daa421de144515c92e5f207bb5c567985e6d8a
Size

70KB
MD5

a309bc091ae05f90f951e4e35c6cc22e
SHA1

b0c69b6fbfe0918114b1d8d8b5a69c91d47a0b21
SHA256

56b8d8c7de0b810d33ff6d1ba9daa421de144515c92e5f207bb5c567985e6d8a
SHA512

3d9de69d43094b5a92b2817f2a3bb93377ccc65c1de3f256023787760a6fa15103a6ef4e56653bb167b2947f57f07bfc15d865a25097e3aac262463849bd6313
SSDEEP

1536:VwM3WRuRDlbZvi1wVhkgFU2a0WHuvVUjE/dXLCn:JmohvP0gC2N+E/hC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
56b8d8c7de0b810d33ff6d1ba9daa421de144515c92e5f207bb5c567985e6d8a

Files

56b8d8c7de0b810d33ff6d1ba9daa421de144515c92e5f207bb5c567985e6d8a
.exe windows:5 windows x86 arch:x86

60676285a204ac2ebf51396ca1d04cdf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
WriteFile
CreateFileW
CreateMailslotW
ReadFile
SetMailslotInfo
ExitThread
IsBadStringPtrW
GetTickCount
ExitProcess
GetLastError
GetProcessHeap
WaitForSingleObject
OutputDebugStringW
CreateThread
GetComputerNameW
CreateSemaphoreW
ReleaseSemaphore
GetProcAddress
GetModuleHandleA
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
InterlockedIncrement
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
RaiseException
InterlockedDecrement
InitializeCriticalSection

msvcrt

_exit
_c_exit
wcsstr
sprintf
wcstoul
swprintf
atol
atoi
wcschr
wcscat
malloc
_XcptFilter
_local_unwind2
rand
time
srand
_wcsicmp
_purecall
_except_handler3
wcscmp
wcslen
wcscpy
free
_cexit
exit
__initenv
__getmainargs
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
__dllonexit
_onexit
_controlfp
_initterm

advapi32

StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
SetServiceStatus

rpcrt4

RpcServerUseProtseqEpW
RpcServerListen
RpcMgmtStopServerListening
UuidFromStringW
RpcBindingFromStringBindingW
RpcStringBindingParseW
RpcStringBindingComposeW
RpcServerRegisterIf2
RpcMgmtSetCancelTimeout
RpcBindingFree
UuidToStringW
RpcStringFreeW
RpcRaiseException
RpcImpersonateClient
RpcRevertToSelf
UuidIsNil
NdrServerCall2
NdrClientCall2
RpcMgmtWaitServerListen
I_RpcBindingIsClientLocal

ntdll

RtlGetNtProductType

netapi32

NetRegisterDomainNameChangeNotification
DsGetDcNameW
NetApiBufferFree
DsRoleGetPrimaryDomainInformation
DsRoleFreeMemory
NetGetDCName
NetServerEnum

activeds

ord15
ord13

adsldpc

ADSIGetNextRow
ADSIGetColumn
ADSIFreeColumn
ADSISetSearchPreference
ADSIExecuteSearch
ADSICloseSearchHandle
ADSIGetObjectAttributes
ADSISetObjectAttributes
ADSICreateDSObject
ADSIOpenDSObject
ADSIDeleteDSObject
ADSICloseDSObject
ADSIGetFirstRow

user32

wsprintfW

Sections

.text
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 800B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

60676285a204ac2ebf51396ca1d04cdf

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

advapi32

rpcrt4

ntdll

netapi32

activeds

adsldpc

user32

Sections

.text Size: 67KB - Virtual size: 66KB

.data Size: 1024B - Virtual size: 800B

.rsrc Size: 1024B - Virtual size: 33KB

.text
Size: 67KB - Virtual size: 66KB

.data
Size: 1024B - Virtual size: 800B

.rsrc
Size: 1024B - Virtual size: 33KB