plights[.]dat | Triage

Sharing

Copy URL Twitter E-mail

General

Target

plights.dat
Size

305KB
MD5

d29ba95774fa1cae1116f3b79cce3be9
SHA1

c51816b4621343cdfe67ef37f7b9e0a4cc60d543
SHA256

470754664a7e32f09d0ce3b5d17446aaaa9363f3d4d387fe272e2435851a351e
SHA512

b1f3ed764587962a7f1b1c25e2aa32516b4ed428e2bd2154ae4e8a8a3678deffc98c6af2e61cffe7a618b50a717f2516ec8b32738ba9a3f8594ba96ad916e648
SSDEEP

6144:d6n50LxGdZ09oiOtGUFzlF4Rndg/O/gZ+ozkcu1MtY+LD/:Qn50SZ09lSz3Ydgm/g8xT1MeW

Score

N/A

Malware Config

Signatures

Files

plights.dat
.dll regsvr32 windows x86

f1d161b5dd26be76887d0343cd8eaff6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineA
ExitProcess
DebugBreak
Sleep
VirtualAlloc
GetFileAttributesA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetModuleHandleA
GetModuleHandleW
lstrcmpA
lstrcmpiA
lstrlenA
WriteConsoleW
CloseHandle
CreateFileW
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
TerminateProcess
RaiseException
RtlUnwind
InterlockedFlushSList
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
MultiByteToWideChar
LCMapStringW
MoveFileExW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineW
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteFile
DecodePointer

shlwapi

PathFindOnPathA
PathFindExtensionA
PathGetDriveNumberA
ord155
StrToIntA
StrStrA
PathFileExistsA
PathFindSuffixArrayA

Exports

Exports

DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 119KB - Virtual size: 119KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 174KB - Virtual size: 174KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f1d161b5dd26be76887d0343cd8eaff6

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

shlwapi

Exports

Exports

Sections

.text Size: 119KB - Virtual size: 119KB

.data Size: 174KB - Virtual size: 174KB

.idata Size: 2KB - Virtual size: 2KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 7KB - Virtual size: 7KB

.text
Size: 119KB - Virtual size: 119KB

.data
Size: 174KB - Virtual size: 174KB

.idata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 7KB - Virtual size: 7KB