DllRegisterServer
EdBO246Q7d
FcVWE844K32H
XbKlg9G
XeDuyaNhZ
Static task
static1
General
-
Target
sliver.zip
-
Size
71.3MB
-
MD5
7120520a7de1c359437f9f9e9d2ac3c0
-
SHA1
30f732400f504de1e50ee1f1f44282ee9865a47b
-
SHA256
ef1dfea4e1e52d662859829cd94414c1734c8fbdbbc036d43da8f92f5d67cda8
-
SHA512
776e7e719f3b8978d87c7ffd006149c04dd07c087f248333bba5471ba46d5626b0e22ceb5cb1ccbee46b3451118a2048d66ffcd2d1ec28afa8f5677868ee7d07
-
SSDEEP
1572864:MlviO9TF5tg3CIttLbiHnDVzgOcsSW5C8dLFAq2eXoa7yEswAU:Mlv59x5tgSI/LuHDVsOcTMC8tuq2eXo0
Score
1/10
Malware Config
Signatures
Files
-
sliver.zip.zip
-
stub1_x64.dll.dll regsvr32 windows x64
9c0cd4eba0f8196335eac83d0bc5a46e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CreateFileA
CloseHandle
GetLastError
CreateFiber
SwitchToFiber
CreateActCtxA
ActivateActCtx
CreateThread
ResumeThread
GetModuleFileNameA
GetModuleHandleA
ReadFile
LockFile
UnlockFile
SetFileAttributesA
DeleteFileA
SetFileTime
VirtualAlloc
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
SetLastError
HeapAlloc
HeapFree
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsSetValue
FreeLibrary
LoadLibraryExW
LCMapStringW
EnterCriticalSection
LeaveCriticalSection
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
ExitProcess
GetModuleHandleExW
GetStringTypeW
MultiByteToWideChar
WideCharToMultiByte
RtlUnwindEx
Exports
Exports
Sections
.text Size: 33KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11.1MB - Virtual size: 11.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 22.4MB - Virtual size: 22.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
stub2x64.ex_.exe windows x64
6cc67e1b4c782dc2b07f26a430d4f88e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetProcessHeap
CreateFileA
CloseHandle
GetComputerNameA
GetLastError
GetCurrentActCtx
GetFileAttributesA
FindFirstFileA
FindNextFileA
GetCurrentProcessId
LockFile
UnlockFile
GetFileType
GetFileInformationByHandle
SetFileAttributesA
OpenFileMappingA
CreateNamedPipeA
ExitProcess
VirtualAlloc
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
GetCurrentProcess
TerminateProcess
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
SetStdHandle
GetStringTypeW
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
CreateFileW
RaiseException
Sections
.text Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14.9MB - Virtual size: 14.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7.5MB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 160B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
stub5_x64.dll.dll regsvr32 windows x64
f7e8b49941b3caecd153b7859b03abf6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CloseHandle
GetCommandLineA
GetLastError
GetCurrentDirectoryA
HeapCreate
TryEnterCriticalSection
ConvertThreadToFiber
CreateFiber
SwitchToFiber
DeleteFileA
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
CreateNamedPipeA
WaitNamedPipeA
PeekNamedPipe
VirtualAlloc
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
MultiByteToWideChar
SetLastError
GetCurrentThreadId
SetStdHandle
GetFileType
DeleteCriticalSection
SetFilePointerEx
WriteConsoleW
GetStdHandle
GetStartupInfoW
HeapAlloc
HeapFree
GetModuleHandleW
GetProcAddress
GetACP
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
FreeLibrary
LoadLibraryExW
LCMapStringW
IsValidCodePage
GetOEMCP
GetCPInfo
CreateFileW
GetProcessHeap
GetStringTypeW
ExitProcess
GetModuleHandleExW
FlushFileBuffers
RaiseException
HeapSize
HeapReAlloc
QueryPerformanceCounter
GetCurrentProcessId
InitializeSListHead
RtlUnwindEx
InterlockedFlushSList
GetModuleFileNameA
FindClose
FindFirstFileExA
FindNextFileA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
Exports
Exports
DllRegisterServer
FmCV792c
JuMPr699RN
Sections
.text Size: 75KB - Virtual size: 74KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 13.2MB - Virtual size: 13.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 19.2MB - Virtual size: 19.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
stub6x64.ex_.exe windows x64
d3d9523ee7d1471dcd8ccc5d727b10e5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CreateFileA
CloseHandle
HeapWalk
CreateActCtxA
ActivateActCtx
DeactivateActCtx
CreateThread
SuspendThread
LockFile
UnlockFile
CreateFileMappingA
OpenFileMappingA
CreateNamedPipeA
ConnectNamedPipe
DisconnectNamedPipe
PeekNamedPipe
ExitProcess
VirtualAlloc
DeleteCriticalSection
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
HeapAlloc
GetLastError
HeapFree
GetModuleHandleW
GetProcAddress
SetLastError
InitializeCriticalSectionAndSpinCount
TlsGetValue
TlsSetValue
FreeLibrary
LoadLibraryExW
LCMapStringW
MultiByteToWideChar
WideCharToMultiByte
GetACP
GetStringTypeW
RaiseException
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
SetStdHandle
GetCPInfo
IsValidCodePage
GetOEMCP
GetModuleHandleExW
SetFilePointerEx
WriteConsoleW
CreateFileW
RtlUnwindEx
Sections
.text Size: 77KB - Virtual size: 77KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12.1MB - Virtual size: 12.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7.5MB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ