d6dc1242e41bf0a6e13e043e1817e8cfab6d276ca2074aa09fa91dc93de40dd2

Sharing

Copy URL

Twitter E-mail

General

Target

d6dc1242e41bf0a6e13e043e1817e8cfab6d276ca2074aa09fa91dc93de40dd2
Size

390KB
MD5

55358a769c013f8b9e717f5a19364b06
SHA1

6e3b481bf16316a0e8c300bd1b0b6fc90c397e80
SHA256

d6dc1242e41bf0a6e13e043e1817e8cfab6d276ca2074aa09fa91dc93de40dd2
SHA512

8674073198cba421615d515aaaf6ec264803fa79318a7d09a4b3303d6c59c99eea2c7ea2192bc690d1bea54679df2c9aa8ecec00a1829ee651d421acffc3bb05
SSDEEP

6144:55pP6uc/1eSRgn0sTw1NeOiVD8KE/lvGfijS7NMKCkAgcJUkJA5pg4m4yO9M3aU7:5Pc/1eiyxgpR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d6dc1242e41bf0a6e13e043e1817e8cfab6d276ca2074aa09fa91dc93de40dd2

Files

d6dc1242e41bf0a6e13e043e1817e8cfab6d276ca2074aa09fa91dc93de40dd2
.dll windows:5 windows x86 arch:x86

82abe9f532bd60ef368dae2a8ca456da

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

DbgPrint
NtClose
NtDeleteKey
NtDeleteValueKey
NtOpenKey
NtQueryKey
NtQuerySystemTime
RtlAbsoluteToSelfRelativeSD
RtlAcquireResourceExclusive
RtlAcquireResourceShared
RtlAddAccessAllowedAce
RtlAddAuditAccessAce
RtlAllocateAndInitializeSid
RtlAllocateHeap
RtlAssert
RtlCreateAcl
RtlCreateSecurityDescriptor
RtlEqualUnicodeString
RtlFreeHeap
RtlFreeSid
RtlGetNtProductType
RtlIdentifierAuthoritySid
RtlInitUnicodeString
RtlInitializeResource
RtlInitializeSid
RtlLengthRequiredSid
RtlLengthSecurityDescriptor
RtlLengthSid
RtlMakeSelfRelativeSD
RtlMapGenericMask
RtlRaiseException
RtlReleaseResource
RtlSetDaclSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlSetSaclSecurityDescriptor
RtlSetSecurityObject
RtlSubAuthorityCountSid
RtlSubAuthoritySid
RtlValidSecurityDescriptor
ZwCreateKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryValueKey
ZwSetValueKey
vDbgPrintExWithPrefix

advapi32

ConvertSidToStringSidW
LsaClose
LsaFreeMemory
LsaOpenPolicy
LsaQueryInformationPolicy
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
SystemFunction006
SystemFunction007
SystemFunction013

kernel32

DeleteCriticalSection
DisableThreadLibraryCalls
EnterCriticalSection
FindResourceW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentVariableA
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcessHeap
GetSystemTimeAsFileTime
GetTickCount
HeapAlloc
HeapFree
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryW
LoadResource
LocalAlloc
LocalFree
LocalReAlloc
LockResource
QueryPerformanceCounter
RtlUnwind
SetLastError
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery

msvcrt

__dllonexit
_amsg_exit
_initterm
_iob
_lock
_onexit
_unlock
abort
bsearch
calloc
free
fwrite
memcmp
memmove
sprintf
strchr
strcmp
strcpy
strcspn
strncmp
swprintf
vfprintf
_vsnprintf
wcscat
wcscpy
wcslen
wcstoul

rpcrt4

NdrServerCall2
RpcMgmtStopServerListening
RpcServerListen
RpcServerRegisterIf
RpcServerUseProtseqEpW

Exports

Exports

SamIAccountRestrictions
SamIAddDSNameToAlias
SamIAddDSNameToGroup
SamIAmIGC
SamIChangePasswordForeignUser
SamIChangePasswordForeignUser2
SamIConnect
SamICreateAccountByRid
SamIDemote
SamIDemoteUndo
SamIDoFSMORoleChange
SamIDsCreateObjectInDomain
SamIDsSetObjectInformation
SamIEnumerateAccountRids
SamIEnumerateInterdomainTrustAccountsForUpgrade
SamIFloatingSingleMasterOpEx
SamIFreeSidAndAttributesList
SamIFreeSidArray
SamIFreeVoid
SamIFree_SAMPR_ALIAS_INFO_BUFFER
SamIFree_SAMPR_DISPLAY_INFO_BUFFER
SamIFree_SAMPR_DOMAIN_INFO_BUFFER
SamIFree_SAMPR_ENUMERATION_BUFFER
SamIFree_SAMPR_GET_GROUPS_BUFFER
SamIFree_SAMPR_GET_MEMBERS_BUFFER
SamIFree_SAMPR_GROUP_INFO_BUFFER
SamIFree_SAMPR_PSID_ARRAY
SamIFree_SAMPR_RETURNED_USTRING_ARRAY
SamIFree_SAMPR_SR_SECURITY_DESCRIPTOR
SamIFree_SAMPR_ULONG_ARRAY
SamIFree_SAMPR_USER_INFO_BUFFER
SamIFree_UserInternal6Information
SamIGCLookupNames
SamIGCLookupSids
SamIGetAliasMembership
SamIGetBootKeyInformation
SamIGetDefaultAdministratorName
SamIGetFixedAttributes
SamIGetInterdomainTrustAccountPasswordsForUpgrade
SamIGetPrivateData
SamIGetResourceGroupMembershipsTransitive
SamIGetSerialNumberDomain
SamIGetUserLogonInformation
SamIGetUserLogonInformation2
SamIGetUserLogonInformationEx
SamIImpersonateNullSession
SamIIncrementPerformanceCounter
SamIInitialize
SamIIsDownlevelDcUpgrade
SamIIsExtendedSidMode
SamIIsRebootAfterPromotion
SamIIsSetupInProgress
SamILoadDownlevelDatabase
SamILoopbackConnect
SamIMixedDomain
SamIMixedDomain2
SamINT4UpgradeInProgress
SamINetLogonPing
SamINotifyDelta
SamINotifyRoleChange
SamINotifyServerDelta
SamIOpenAccount
SamIOpenUserByAlternateId
SamIPromote
SamIPromoteUndo
SamIQueryServerRole
SamIQueryServerRole2
SamIRelaceDownlevelDatabase
SamIRemoveDSNameFromAlias
SamIRemoveDSNameFromGroup
SamIResetBadPwdCountOnPdc
SamIRetrievePrimaryCredentials
SamIRevertNullSession
SamISameSite
SamISetAuditingInformation
SamISetMixedDomainFlag
SamISetPasswordForeignUser
SamISetPasswordForeignUser2
SamISetPasswordInfoOnPdc
SamISetPrivateData
SamISetSerialNumberDomain
SamIStorePrimaryCredentials
SamIUPNFromUserHandle
SamIUnLoadDownlevelDatabase
SamIUpdateLogonStatistics
SampAbortSingleLoopbackTask
SampAccountControlToFlags
SampAcquireSamLockExclusive
SampAcquireWriteLock
SampCommitBufferedWrites
SampConvertNt4SdToNt5Sd
SampDsChangePasswordUser
SampFlagsToAccountControl
SampGetDefaultSecurityDescriptorForClass
SampGetSerialNumberDomain2
SampInitializeRegistry
SampInitializeSdConversion
SampInvalidateDomainCache
SampInvalidateRidRange
SampNetLogonNotificationRequired
SampNotifyReplicatedInChange
SampProcessSingleLoopbackTask
SampReleaseSamLockExclusive
SampReleaseWriteLock
SampRtlConvertUlongToUnicodeString
SampSetSerialNumberDomain2
SampUsingDsData
SampWriteGroupType
SamrAddMemberToAlias
SamrAddMemberToGroup
SamrAddMultipleMembersToAlias
SamrChangePasswordUser
SamrCloseHandle
SamrConnect
SamrCreateAliasInDomain
SamrCreateGroupInDomain
SamrCreateUser2InDomain
SamrCreateUserInDomain
SamrDeleteAlias
SamrDeleteGroup
SamrDeleteUser
SamrEnumerateAliasesInDomain
SamrEnumerateDomainsInSamServer
SamrEnumerateGroupsInDomain
SamrEnumerateUsersInDomain
SamrGetAliasMembership
SamrGetGroupsForUser
SamrGetMembersInAlias
SamrGetMembersInGroup
SamrGetUserDomainPasswordInformation
SamrLookupDomainInSamServer
SamrLookupIdsInDomain
SamrLookupNamesInDomain
SamrOpenAlias
SamrOpenDomain
SamrOpenGroup
SamrOpenUser
SamrQueryDisplayInformation
SamrQueryInformationAlias
SamrQueryInformationDomain
SamrQueryInformationGroup
SamrQueryInformationUser
SamrQuerySecurityObject
SamrRemoveMemberFromAlias
SamrRemoveMemberFromForeignDomain
SamrRemoveMemberFromGroup
SamrRemoveMultipleMembersFromAlias
SamrRidToSid
SamrSetInformationAlias
SamrSetInformationDomain
SamrSetInformationGroup
SamrSetInformationUser
SamrSetMemberAttributesOfGroup
SamrSetSecurityObject
SamrShutdownSamServer
SamrTestPrivateFunctionsDomain
SamrTestPrivateFunctionsUser
SamrUnicodeChangePasswordUser2

Sections

.text
Size: 131KB - Virtual size: 130KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 728B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rossym
Size: 162KB - Virtual size: 162KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

82abe9f532bd60ef368dae2a8ca456da

Headers

File Characteristics

Imports

ntdll

advapi32

kernel32

msvcrt

rpcrt4

Exports

Exports

Sections

.text Size: 131KB - Virtual size: 130KB

.data Size: 1024B - Virtual size: 728B

.rdata Size: 33KB - Virtual size: 32KB

.bss Size: - Virtual size: 5KB

.edata Size: 5KB - Virtual size: 5KB

.idata Size: 4KB - Virtual size: 3KB

.CRT Size: 512B - Virtual size: 44B

.tls Size: 512B - Virtual size: 8B

.rsrc Size: 40KB - Virtual size: 39KB

.reloc Size: 10KB - Virtual size: 9KB

.rossym Size: 162KB - Virtual size: 162KB

.text
Size: 131KB - Virtual size: 130KB

.data
Size: 1024B - Virtual size: 728B

.rdata
Size: 33KB - Virtual size: 32KB

.bss
Size: - Virtual size: 5KB

.edata
Size: 5KB - Virtual size: 5KB

.idata
Size: 4KB - Virtual size: 3KB

.CRT
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 8B

.rsrc
Size: 40KB - Virtual size: 39KB

.reloc
Size: 10KB - Virtual size: 9KB

.rossym
Size: 162KB - Virtual size: 162KB