d693197807347a0467d5d295818d1fc427b82be0f358c8a8f52c6169a4745ba6

Sharing

Copy URL Twitter E-mail

General

Target
d693197807347a0467d5d295818d1fc427b82be0f358c8a8f52c6169a4745ba6
Size 320KB
Sample260825-xbbaast1cs
SHA256 d693197807347a0467d5d295818d1fc427b82be0f358c8a8f52c6169a4745ba6
MD5 ec2da42e7644ab9c0fa65b2724f2f573
SHA1 cf4b380dd821b8910bff456a8ae7153bacfff6d9
SHA512 80bf4593941d885c94e1ee2b01ab291144bbc0c7ab58379a9f8aacc0ef3584d0efd43a1587ef8997ed9652d56b2e0bfc4f8eb081c3a4743b16dc59e51634c41c
SSDEEP 3072:BASQVWOMsvL5zbWA6Wptx1VbimWnivY2gaHgGNZ99zsfK3Mg1HlRlX0lm5:BCR6WptxWmWnivY2B3NVM4jRlX0lm5
TLSH
T1CC64F840F3EAD9E5FEB72A701569E2AE1A387950C931CF8BF500495E0933ED2BB50716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d693197807347a0467d5d295818d1fc427b82be0f358c8a8f52c6169a4745ba6

File Explorer

d693197807347a0467d5d295818d1fc427b82be0f358c8a8f52c6169a4745ba6

.dll 320KB

d693197807347a0467d5d295818d1fc427b82be0f358c8a8f52c6169a4745ba6

IMPHASH 8211e1c0dd842688cf8d152a5920b25c
SHA256 d693197807347a0467d5d295818d1fc427b82be0f358c8a8f52c6169a4745ba6
MD5 ec2da42e7644ab9c0fa65b2724f2f573
SHA1 cf4b380dd821b8910bff456a8ae7153bacfff6d9
SHA512 80bf4593941d885c94e1ee2b01ab291144bbc0c7ab58379a9f8aacc0ef3584d0efd43a1587ef8997ed9652d56b2e0bfc4f8eb081c3a4743b16dc59e51634c41c
SSDEEP 3072:BASQVWOMsvL5zbWA6Wptx1VbimWnivY2gaHgGNZ99zsfK3Mg1HlRlX0lm5:BCR6WptxWmWnivY2B3NVM4jRlX0lm5
TLSH
T1CC64F840F3EAD9E5FEB72A701569E2AE1A387950C931CF8BF500495E0933ED2BB50716
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

129872

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

ntdll

DbgPrint NtClose NtDeleteKey NtDeleteValueKey NtOpenKey NtQueryKey NtQuerySystemTime RtlAbsoluteToSelfRelativeSD RtlAcquireResourceExclusive RtlAcquireResourceShared RtlAddAccessAllowedAce RtlAddAuditAccessAce RtlAllocateAndInitializeSid RtlAllocateHeap RtlCreateAcl RtlCreateSecurityDescriptor RtlEqualUnicodeString RtlFreeHeap RtlFreeSid RtlGetNtProductType RtlIdentifierAuthoritySid RtlInitUnicodeString RtlInitializeResource RtlInitializeSid RtlLengthRequiredSid RtlLengthSecurityDescriptor RtlLengthSid RtlMakeSelfRelativeSD RtlMapGenericMask RtlRaiseException RtlReleaseResource RtlSetDaclSecurityDescriptor RtlSetGroupSecurityDescriptor RtlSetOwnerSecurityDescriptor RtlSetSaclSecurityDescriptor RtlSetSecurityObject RtlSubAuthorityCountSid RtlSubAuthoritySid RtlValidSecurityDescriptor ZwCreateKey ZwEnumerateKey ZwEnumerateValueKey ZwQueryValueKey ZwSetValueKey vDbgPrintExWithPrefix

advapi32

ConvertSidToStringSidW LsaClose LsaFreeMemory LsaOpenPolicy LsaQueryInformationPolicy RegCloseKey RegCreateKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW SystemFunction006 SystemFunction007 SystemFunction013

kernel32

DeleteCriticalSection DisableThreadLibraryCalls EnterCriticalSection FindResourceW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableA GetLastError GetModuleHandleA GetModuleHandleW GetProcessHeap GetSystemTimeAsFileTime GetTickCount HeapAlloc HeapFree InitializeCriticalSection LeaveCriticalSection LoadLibraryW LoadResource LocalAlloc LocalFree LocalReAlloc LockResource QueryPerformanceCounter RtlUnwind SetLastError SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery

msvcrt

__dllonexit _amsg_exit _initterm _iob _lock _onexit _snprintf _unlock _vsnprintf abort bsearch calloc free fwrite memcmp memmove sprintf strchr strcmp strcpy strcspn strlen strncmp vfprintf swprintf wcscat wcscpy wcslen wcstoul

rpcrt4

NdrServerCall2 RpcMgmtStopServerListening RpcServerListen RpcServerRegisterIf RpcServerUseProtseqEpW

SamIAccountRestrictions SamIAddDSNameToAlias SamIAddDSNameToGroup SamIAmIGC SamIChangePasswordForeignUser SamIChangePasswordForeignUser2 SamIConnect SamICreateAccountByRid SamIDemote SamIDemoteUndo SamIDoFSMORoleChange SamIDsCreateObjectInDomain SamIDsSetObjectInformation SamIEnumerateAccountRids SamIEnumerateInterdomainTrustAccountsForUpgrade SamIFloatingSingleMasterOpEx SamIFreeSidAndAttributesList SamIFreeSidArray SamIFreeVoid SamIFree_SAMPR_ALIAS_INFO_BUFFER SamIFree_SAMPR_DISPLAY_INFO_BUFFER SamIFree_SAMPR_DOMAIN_INFO_BUFFER SamIFree_SAMPR_ENUMERATION_BUFFER SamIFree_SAMPR_GET_GROUPS_BUFFER SamIFree_SAMPR_GET_MEMBERS_BUFFER SamIFree_SAMPR_GROUP_INFO_BUFFER SamIFree_SAMPR_PSID_ARRAY SamIFree_SAMPR_RETURNED_USTRING_ARRAY SamIFree_SAMPR_SR_SECURITY_DESCRIPTOR SamIFree_SAMPR_ULONG_ARRAY SamIFree_SAMPR_USER_INFO_BUFFER SamIFree_UserInternal6Information SamIGCLookupNames SamIGCLookupSids SamIGetAliasMembership SamIGetBootKeyInformation SamIGetDefaultAdministratorName SamIGetFixedAttributes SamIGetInterdomainTrustAccountPasswordsForUpgrade SamIGetPrivateData SamIGetResourceGroupMembershipsTransitive SamIGetSerialNumberDomain SamIGetUserLogonInformation SamIGetUserLogonInformation2 SamIGetUserLogonInformationEx SamIImpersonateNullSession SamIIncrementPerformanceCounter SamIInitialize SamIIsDownlevelDcUpgrade SamIIsExtendedSidMode SamIIsRebootAfterPromotion SamIIsSetupInProgress SamILoadDownlevelDatabase SamILoopbackConnect SamIMixedDomain SamIMixedDomain2 SamINT4UpgradeInProgress SamINetLogonPing SamINotifyDelta SamINotifyRoleChange SamINotifyServerDelta SamIOpenAccount SamIOpenUserByAlternateId SamIPromote SamIPromoteUndo SamIQueryServerRole SamIQueryServerRole2 SamIRelaceDownlevelDatabase SamIRemoveDSNameFromAlias SamIRemoveDSNameFromGroup SamIResetBadPwdCountOnPdc SamIRetrievePrimaryCredentials SamIRevertNullSession SamISameSite SamISetAuditingInformation SamISetMixedDomainFlag SamISetPasswordForeignUser SamISetPasswordForeignUser2 SamISetPasswordInfoOnPdc SamISetPrivateData SamISetSerialNumberDomain SamIStorePrimaryCredentials SamIUPNFromUserHandle SamIUnLoadDownlevelDatabase SamIUpdateLogonStatistics SampAbortSingleLoopbackTask SampAccountControlToFlags SampAcquireSamLockExclusive SampAcquireWriteLock SampCommitBufferedWrites SampConvertNt4SdToNt5Sd SampDsChangePasswordUser SampFlagsToAccountControl SampGetDefaultSecurityDescriptorForClass SampGetSerialNumberDomain2 SampInitializeRegistry SampInitializeSdConversion SampInvalidateDomainCache SampInvalidateRidRange SampNetLogonNotificationRequired SampNotifyReplicatedInChange SampProcessSingleLoopbackTask SampReleaseSamLockExclusive SampReleaseWriteLock SampRtlConvertUlongToUnicodeString SampSetSerialNumberDomain2 SampUsingDsData SampWriteGroupType SamrAddMemberToAlias SamrAddMemberToGroup SamrAddMultipleMembersToAlias SamrChangePasswordUser SamrCloseHandle SamrConnect SamrCreateAliasInDomain SamrCreateGroupInDomain SamrCreateUser2InDomain SamrCreateUserInDomain SamrDeleteAlias SamrDeleteGroup SamrDeleteUser SamrEnumerateAliasesInDomain SamrEnumerateDomainsInSamServer SamrEnumerateGroupsInDomain SamrEnumerateUsersInDomain SamrGetAliasMembership SamrGetGroupsForUser SamrGetMembersInAlias SamrGetMembersInGroup SamrGetUserDomainPasswordInformation SamrLookupDomainInSamServer SamrLookupIdsInDomain SamrLookupNamesInDomain SamrOpenAlias SamrOpenDomain SamrOpenGroup SamrOpenUser SamrQueryDisplayInformation SamrQueryInformationAlias SamrQueryInformationDomain SamrQueryInformationGroup SamrQueryInformationUser SamrQuerySecurityObject SamrRemoveMemberFromAlias SamrRemoveMemberFromForeignDomain SamrRemoveMemberFromGroup SamrRemoveMultipleMembersFromAlias SamrRidToSid SamrSetInformationAlias SamrSetInformationDomain SamrSetInformationGroup SamrSetInformationUser SamrSetMemberAttributesOfGroup SamrSetSecurityObject SamrShutdownSamServer SamrTestPrivateFunctionsDomain SamrTestPrivateFunctionsUser SamrUnicodeChangePasswordUser2

Name

.text

Size

127KB

Virtual Size

127KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

728B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

43KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

d693197807347a0467d5d295818d1fc427b82be0f358c8a8f52c6169a4745ba6

ntdll

advapi32

kernel32

msvcrt

rpcrt4

generic