098379804d811097152efeb23e0557acc8fb8790f033d57c1d3194e64d0a32be

Sharing

Copy URL

Twitter E-mail

General

Target

098379804d811097152efeb23e0557acc8fb8790f033d57c1d3194e64d0a32be
Size

39KB
MD5

f0d677e4e60bf12a3a44f7e474d222d3
SHA1

bd94b1d4facddd5126c7c58a118ca8f44b6cca69
SHA256

098379804d811097152efeb23e0557acc8fb8790f033d57c1d3194e64d0a32be
SHA512

e89888321739c1161cc64f7bc69cb9b2765129d6bfb13c71777f490c3c0ebf783d53bf2872671b8bb5b13e2398332f168a1e80b7a36da71f9e0c70f9cbdbd8de
SSDEEP

768:My/z+kKf7HRPabYWo/kvzvbFHY92K+LThYijepD8SoUdxSjvEsivqzD:YkeHEbNpzDMEKiCpwUdd3v8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
098379804d811097152efeb23e0557acc8fb8790f033d57c1d3194e64d0a32be

Files

098379804d811097152efeb23e0557acc8fb8790f033d57c1d3194e64d0a32be
.exe windows:5 windows x86 arch:x86

f8984e30c1766647d450ef0c7cf5f665

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

ismserv.pdb

Imports

msvcrt

_ultoa
_ultow
malloc
iswcntrl
_itoa
_i64tow
_itow
strtoul
isxdigit
wcslen
realloc
memmove
free
??2@YAPAXI@Z
_wcsicmp
_controlfp
_onexit
??3@YAXPAX@Z
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__initenv
exit
_except_handler3
_XcptFilter
_exit
_c_exit
wcschr
wcsncpy
wcscmp
printf
_local_unwind2
wcscpy
wcscat
_beginthreadex
__dllonexit
_cexit

advapi32

RegCloseKey
OpenThreadToken
GetTokenInformation
RegNotifyChangeKeyValue
RegOpenKeyA
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
FreeSid
OpenServiceA
DeleteService
OpenSCManagerA
CreateServiceA
CloseServiceHandle
SetServiceStatus
RegSetValueExA
ReportEventW
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegQueryValueExA

kernel32

LocalFree
LoadLibraryExA
FormatMessageW
GetCurrentThread
MultiByteToWideChar
GetModuleHandleA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
LoadLibraryA
InitializeCriticalSection
GetLastError
CreateEventA
GetModuleFileNameA
HeapFree
HeapAlloc
GetProcessHeap
WaitForMultipleObjects
SetEvent
FreeLibrary
GetProcAddress
LoadLibraryW
WaitForSingleObject
CloseHandle
GetEnvironmentVariableW
SetConsoleCtrlHandler
lstrcmpiA
CreateEventW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
LocalAlloc

wldap32

ord208
ord73
ord13
ord133
ord140
ord40
ord41
ord18
ord10
ord194
ord26
ord14
ord79
ord224
ord27
ord142
ord145
ord147

rpcrt4

NdrServerCall2
RpcMgmtWaitServerListen
RpcMgmtStopServerListening
RpcServerUseProtseqEpExA
RpcServerRegisterIf
RpcServerRegisterAuthInfoA
RpcServerListen

ntdll

DbgPrint
_vsnwprintf
RtlConvertSidToUnicodeString
RtlLargeIntegerToChar
RtlAcquireResourceShared
RtlReleaseResource
RtlDeleteCriticalSection
RtlAcquireResourceExclusive
RtlInitializeCriticalSection
RtlDeleteResource
RtlEnterCriticalSection
RtlLeaveCriticalSection
RtlInitializeResource

netapi32

NetAlertRaiseEx

cryptdll

MD5Final
MD5Update
MD5Init

Exports

Exports

DebPrint
DebugTest
DoAssert
DoLogEvent
DoLogEventAndTrace
DoLogOverride
DoLogUnhandledError
DsGetEventConfig

Sections

.text
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 29B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f8984e30c1766647d450ef0c7cf5f665

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

advapi32

kernel32

wldap32

rpcrt4

ntdll

netapi32

cryptdll

Exports

Exports

Sections

.text Size: 35KB - Virtual size: 35KB

.data Size: 1024B - Virtual size: 1KB

.tls Size: 512B - Virtual size: 29B

.rsrc Size: 1KB - Virtual size: 33KB

.text
Size: 35KB - Virtual size: 35KB

.data
Size: 1024B - Virtual size: 1KB

.tls
Size: 512B - Virtual size: 29B

.rsrc
Size: 1KB - Virtual size: 33KB