646f443fdb8d8[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

646f443fdb8d8.dll
Size

615KB
MD5

bc339c57f60e71778611eb8b17163af6
SHA1

a7128b7d2d33376598ddbca3edc313df7f36ce63
SHA256

ea2d71af9790b0a058d0d166c52c2609a1a106053189c515b6059b5f18e9e48b
SHA512

90cc742e02a0dbe5887c328338f9e2d88565b0bf083cade78a944dc09f464c6d8d63437c35aeee759ef528745f9ba3fb277ab5a5b2a6acf128d41d050bd42065
SSDEEP

12288:UNCP9L6JD1GK3SBKXbZAPkTG5k0JNu3pANyvkn79:UNUmMKXXeMTuXIWcvI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
646f443fdb8d8.dll

Files

646f443fdb8d8.dll
.dll regsvr32 windows x86

a622cc1fa95693078c9a25f4b07e40d4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CreateFileA
CloseHandle
GetComputerNameA
GetLastError
GetCurrentThreadId
SetFilePointer
CreateFileMappingA
CreateNamedPipeA
WaitNamedPipeA
VirtualAlloc
GetNamedPipeInfo
GetDiskFreeSpaceA
GetLocalTime

Exports

Exports

DllRegisterServer

Sections

.text
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 320KB - Virtual size: 319KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 270KB - Virtual size: 270KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ