title32[.]tmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

title32.tmp
Size

161KB
MD5

821da3624fb11432a7ec2cd17afd3acd
SHA1

442a1e31ba4a9530513fd183fb06512e11e77b08
SHA256

6df2b4adfadfcaaf3f2844f193e4fe034d78dbb9a5c65ccddedba00c9834e2c3
SHA512

51c7c946c98276ce206328931cdbe9153b1f372a37b86dd7ef5c28c7c918e69ba97103adfd29a678332a298b92e4b389fe7b30a94b0a970983c5e7a05916adf6
SSDEEP

3072:J2K11OdZ8dPXHRstm2CenCxeNm3dUEsu7mxr7zd8DzVPo6H:5Q8J3KQxc6p

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
title32.tmp

Files

title32.tmp
.dll windows x64

e02e1c0c5705284295902a39046bed01

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

LookupAccountSidW
GetTokenInformation
OpenProcessToken
ConvertSidToStringSidW
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegOpenKeyExW
RegQueryInfoKeyA
RegQueryValueExA
RegQueryValueExW
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
GetUserNameW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

kernel32

GetStdHandle
GetFileType
GetConsoleCP
GetConsoleMode
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
LoadLibraryExA
GetModuleHandleW
FreeLibrary
VirtualQuery
VirtualProtect
RaiseException
FormatMessageA
LoadLibraryA
GetSystemDirectoryA
GetACP
IsValidCodePage
GetNativeSystemInfo
GetVersionExA
GetWindowsDirectoryA
GetSystemDirectoryW
GetSystemInfo
IsProcessorFeaturePresent
GetTempPathW
GetCurrentDirectoryW
PeekConsoleInputA
GetNumberOfConsoleInputEvents
PeekNamedPipe
WriteFile
SetFilePointerEx
SetFileInformationByHandle
ReadFile
GetFileSizeEx
GetDriveTypeW
FlushFileBuffers
GetModuleHandleExW
DeviceIoControl
SetLastError
SetFileTime
SetFileAttributesW
RemoveDirectoryW
GetVolumePathNameW
GetVolumeInformationW
GetLogicalDrives
GetFullPathNameW
GetFileTime
GetFileInformationByHandle
GetFileAttributesExW
GetFileAttributesW
GetDiskFreeSpaceExW
FindNextFileW
FindFirstFileW
FindClose
DeleteFileW
CreateDirectoryW
SetErrorMode
GetUserGeoID
GetGeoInfoA
GetLocaleInfoA
MultiByteToWideChar
GetDynamicTimeZoneInformation
GetTimeZoneInformation
ResetEvent
GetConsoleWindow
WideCharToMultiByte
FormatMessageW
GetProcessId
CreateProcessW
CreatePipe
SetHandleInformation
GetHandleInformation
CreateFileW
Process32Next
Process32First
CreateToolhelp32Snapshot
QueryFullProcessImageNameW
LocalFree
OpenProcess
GetExitCodeProcess
TerminateProcess
GetCurrentProcessId
GetProcessTimes
WaitForMultipleObjects
GetLastError
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetEnvironmentStringsW
GetEnvironmentStrings
GetUserDefaultLCID
GetUserDefaultUILanguage
GetProcAddress
SetConsoleMode
CloseHandle
GetModuleHandleA

Exports

Exports

eetStringPlatformChars
enitializeEncoding
eDK_Canonicalize
eDK_LoadSystemLibrary
eNI_OnLoad
eNU_CallMethodByName
eNU_CallMethodByNameV
eNU_CallStaticMethodByName
eNU_ClassString
eNU_CopyObjectArray
eNU_GetEnv
eNU_GetFieldByName
eNU_GetStaticFieldByName
eNU_GetStringPlatformChars
eNU_IsInstanceOfByName
eNU_NewObjectByName
eNU_NewStringPlatform
eNU_ReleaseStringPlatformChars
eNU_SetFieldByName
eNU_ThrowArrayIndexOutOfBoundsException
eNU_ThrowByName
eNU_ThrowByNameWithLastError
eNU_ThrowByNameWithMessageAndLastError
eNU_ThrowClassNotFoundException
eNU_ThrowIOException
eNU_ThrowIOExceptionWithLastError
eNU_ThrowIllegalArgumentException
eNU_ThrowInternalError
eNU_ThrowNullPointerException
eNU_ThrowOutOfMemoryError
eNU_ToString
eava_java_io_Console_echo
eava_java_io_Console_encoding
eava_java_io_Console_istty
eava_java_io_FileCleanable_cleanupClose0
eava_java_io_FileDescriptor_close0
eava_java_io_FileDescriptor_getAppend
eava_java_io_FileDescriptor_getHandle
eava_java_io_FileDescriptor_initIDs
eava_java_io_FileDescriptor_sync
eava_java_io_FileInputStream_available0
eava_java_io_FileInputStream_initIDs
eava_java_io_FileInputStream_length0
eava_java_io_FileInputStream_open0
eava_java_io_FileInputStream_position0
eava_java_io_FileInputStream_read0
eava_java_io_FileInputStream_readBytes
eava_java_io_FileInputStream_skip0
eava_java_io_FileOutputStream_initIDs
eava_java_io_FileOutputStream_open0
eava_java_io_FileOutputStream_write
eava_java_io_FileOutputStream_writeBytes
eava_java_io_ObjectStreamClass_hasStaticInitializer
eava_java_io_ObjectStreamClass_initNative
eava_java_io_RandomAccessFile_getFilePointer
eava_java_io_RandomAccessFile_initIDs
eava_java_io_RandomAccessFile_length
eava_java_io_RandomAccessFile_open0
eava_java_io_RandomAccessFile_read0
eava_java_io_RandomAccessFile_readBytes
eava_java_io_RandomAccessFile_seek0
eava_java_io_RandomAccessFile_setLength
eava_java_io_RandomAccessFile_write0
eava_java_io_RandomAccessFile_writeBytes
eava_java_io_WinNTFileSystem_canonicalize0
eava_java_io_WinNTFileSystem_canonicalizeWithPrefix0
eava_java_io_WinNTFileSystem_checkAccess
eava_java_io_WinNTFileSystem_createDirectory
eava_java_io_WinNTFileSystem_createFileExclusively
eava_java_io_WinNTFileSystem_delete0
eava_java_io_WinNTFileSystem_getBooleanAttributes
eava_java_io_WinNTFileSystem_getDriveDirectory
eava_java_io_WinNTFileSystem_getLastModifiedTime
eava_java_io_WinNTFileSystem_getLength
eava_java_io_WinNTFileSystem_getNameMax0
eava_java_io_WinNTFileSystem_getSpace0
eava_java_io_WinNTFileSystem_initIDs
eava_java_io_WinNTFileSystem_list
eava_java_io_WinNTFileSystem_listRoots0
eava_java_io_WinNTFileSystem_rename0
eava_java_io_WinNTFileSystem_setLastModifiedTime
eava_java_io_WinNTFileSystem_setPermission
eava_java_io_WinNTFileSystem_setReadOnly
eava_java_lang_ClassLoader_defineClass0
eava_java_lang_ClassLoader_defineClass1
eava_java_lang_ClassLoader_defineClass2
eava_java_lang_ClassLoader_findBootstrapClass
eava_java_lang_ClassLoader_findLoadedClass0
eava_java_lang_ClassLoader_registerNatives
eava_java_lang_Class_forName0
eava_java_lang_Class_getPrimitiveClass
eava_java_lang_Class_isAssignableFrom
eava_java_lang_Class_isInstance
eava_java_lang_Class_registerNatives
eava_java_lang_Double_doubleToRawLongBits
eava_java_lang_Double_longBitsToDouble
eava_java_lang_Float_floatToRawIntBits
eava_java_lang_Float_intBitsToFloat
eava_java_lang_Module_addExports0
eava_java_lang_Module_addExportsToAll0
eava_java_lang_Module_addExportsToAllUnnamed0
eava_java_lang_Module_addReads0
eava_java_lang_Module_defineModule0
eava_java_lang_NullPointerException_getExtendedNPEMessage
eava_java_lang_Object_getClass
eava_java_lang_ProcessEnvironment_environmentBlock
eava_java_lang_ProcessHandleImpl_00024Info_info0
eava_java_lang_ProcessHandleImpl_00024Info_initIDs
eava_java_lang_ProcessHandleImpl_destroy0
eava_java_lang_ProcessHandleImpl_getCurrentPid0
eava_java_lang_ProcessHandleImpl_getProcessPids0
eava_java_lang_ProcessHandleImpl_initNative
eava_java_lang_ProcessHandleImpl_isAlive0
eava_java_lang_ProcessHandleImpl_parent0
eava_java_lang_ProcessHandleImpl_waitForProcessExit0
eava_java_lang_ProcessImpl_closeHandle
eava_java_lang_ProcessImpl_create
eava_java_lang_ProcessImpl_getExitCodeProcess
eava_java_lang_ProcessImpl_getProcessId0
eava_java_lang_ProcessImpl_getStillActive
eava_java_lang_ProcessImpl_isProcessAlive
eava_java_lang_ProcessImpl_openForAtomicAppend
eava_java_lang_ProcessImpl_terminateProcess
eava_java_lang_ProcessImpl_waitForInterruptibly
eava_java_lang_ProcessImpl_waitForTimeoutInterruptibly
eava_java_lang_Runtime_availableProcessors
eava_java_lang_Runtime_freeMemory
eava_java_lang_Runtime_gc
eava_java_lang_Runtime_maxMemory
eava_java_lang_Runtime_totalMemory
eava_java_lang_SecurityManager_getClassContext
eava_java_lang_Shutdown_beforeHalt
eava_java_lang_Shutdown_halt0
eava_java_lang_StackStreamFactory_00024AbstractStackWalker_callStackWalk
eava_java_lang_StackStreamFactory_00024AbstractStackWalker_fetchStackFrames
eava_java_lang_StackStreamFactory_checkStackWalkModes
eava_java_lang_StackTraceElement_initStackTraceElement
eava_java_lang_StackTraceElement_initStackTraceElements
eava_java_lang_StrictMath_IEEEremainder
eava_java_lang_StrictMath_acos
eava_java_lang_StrictMath_asin
eava_java_lang_StrictMath_atan
eava_java_lang_StrictMath_atan2
eava_java_lang_StrictMath_cos
eava_java_lang_StrictMath_cosh
eava_java_lang_StrictMath_expm1
eava_java_lang_StrictMath_log
eava_java_lang_StrictMath_log10
eava_java_lang_StrictMath_log1p
eava_java_lang_StrictMath_sin
eava_java_lang_StrictMath_sinh
eava_java_lang_StrictMath_sqrt
eava_java_lang_StrictMath_tan
eava_java_lang_StrictMath_tanh
eava_java_lang_StringUTF16_isBigEndian
eava_java_lang_String_intern
eava_java_lang_System_identityHashCode
eava_java_lang_System_mapLibraryName
eava_java_lang_System_registerNatives
eava_java_lang_System_setErr0
eava_java_lang_System_setIn0
eava_java_lang_System_setOut0
eava_java_lang_Thread_clearInterruptEvent
eava_java_lang_Thread_registerNatives
eava_java_lang_Throwable_fillInStackTrace
eava_java_lang_invoke_LambdaProxyClassArchive_addToArchive
eava_java_lang_invoke_LambdaProxyClassArchive_findFromArchive
eava_java_lang_ref_PhantomReference_refersTo0
eava_java_lang_ref_Reference_clear0
eava_java_lang_ref_Reference_getAndClearReferencePendingList
eava_java_lang_ref_Reference_hasReferencePendingList
eava_java_lang_ref_Reference_refersTo0
eava_java_lang_ref_Reference_waitForReferencePendingList
eava_java_lang_reflect_Array_get
eava_java_lang_reflect_Array_getBoolean
eava_java_lang_reflect_Array_getByte
eava_java_lang_reflect_Array_getChar
eava_java_lang_reflect_Array_getDouble
eava_java_lang_reflect_Array_getFloat
eava_java_lang_reflect_Array_getInt
eava_java_lang_reflect_Array_getLength
eava_java_lang_reflect_Array_getLong
eava_java_lang_reflect_Array_getShort
eava_java_lang_reflect_Array_multiNewArray
eava_java_lang_reflect_Array_newArray
eava_java_lang_reflect_Array_set
eava_java_lang_reflect_Array_setBoolean
eava_java_lang_reflect_Array_setByte
eava_java_lang_reflect_Array_setChar
eava_java_lang_reflect_Array_setDouble
eava_java_lang_reflect_Array_setFloat
eava_java_lang_reflect_Array_setInt
eava_java_lang_reflect_Array_setLong
eava_java_lang_reflect_Array_setShort
eava_java_lang_reflect_Executable_getParameters0
eava_java_lang_reflect_Executable_getTypeAnnotationBytes0
eava_java_lang_reflect_Field_getTypeAnnotationBytes0
eava_java_security_AccessController_ensureMaterializedForStackWalk
eava_java_security_AccessController_getInheritedAccessControlContext
eava_java_security_AccessController_getProtectionDomain
eava_java_security_AccessController_getStackAccessControlContext
eava_java_util_TimeZone_getSystemGMTOffsetID
eava_java_util_TimeZone_getSystemTimeZoneID
eava_java_util_concurrent_atomic_AtomicLong_VMSupportsCS8
eava_jdk_internal_loader_BootLoader_getSystemPackageLocation
eava_jdk_internal_loader_BootLoader_getSystemPackageNames
eava_jdk_internal_loader_BootLoader_setBootLoaderUnnamedModule0
eava_jdk_internal_loader_NativeLibraries_findBuiltinLib
eava_jdk_internal_loader_NativeLibraries_findEntry0
eava_jdk_internal_loader_NativeLibraries_load
eava_jdk_internal_loader_NativeLibraries_unload
eava_jdk_internal_misc_CDS_defineArchivedModules
eava_jdk_internal_misc_CDS_dumpClassList
eava_jdk_internal_misc_CDS_dumpDynamicArchive
eava_jdk_internal_misc_CDS_getRandomSeedForDumping
eava_jdk_internal_misc_CDS_initializeFromArchive
eava_jdk_internal_misc_CDS_isDumpingArchive0
eava_jdk_internal_misc_CDS_isDumpingClassList0
eava_jdk_internal_misc_CDS_isSharingEnabled0
eava_jdk_internal_misc_CDS_logLambdaFormInvoker
eava_jdk_internal_misc_Signal_findSignal0
eava_jdk_internal_misc_Signal_handle0
eava_jdk_internal_misc_Signal_raise0
eava_jdk_internal_misc_VM_getRuntimeArguments
eava_jdk_internal_misc_VM_getegid
eava_jdk_internal_misc_VM_geteuid
eava_jdk_internal_misc_VM_getgid
eava_jdk_internal_misc_VM_getuid
eava_jdk_internal_misc_VM_initialize
eava_jdk_internal_misc_VM_latestUserDefinedLoader0
eava_jdk_internal_reflect_ConstantPool_getClassAt0
eava_jdk_internal_reflect_ConstantPool_getClassAtIfLoaded0
eava_jdk_internal_reflect_ConstantPool_getClassRefIndexAt0
eava_jdk_internal_reflect_ConstantPool_getDoubleAt0
eava_jdk_internal_reflect_ConstantPool_getFieldAt0
eava_jdk_internal_reflect_ConstantPool_getFieldAtIfLoaded0
eava_jdk_internal_reflect_ConstantPool_getFloatAt0
eava_jdk_internal_reflect_ConstantPool_getIntAt0
eava_jdk_internal_reflect_ConstantPool_getLongAt0
eava_jdk_internal_reflect_ConstantPool_getMemberRefInfoAt0
eava_jdk_internal_reflect_ConstantPool_getMethodAt0
eava_jdk_internal_reflect_ConstantPool_getMethodAtIfLoaded0
eava_jdk_internal_reflect_ConstantPool_getNameAndTypeRefIndexAt0
eava_jdk_internal_reflect_ConstantPool_getNameAndTypeRefInfoAt0
eava_jdk_internal_reflect_ConstantPool_getSize0
eava_jdk_internal_reflect_ConstantPool_getStringAt0
eava_jdk_internal_reflect_ConstantPool_getTagAt0
eava_jdk_internal_reflect_ConstantPool_getUTF8At0
eava_jdk_internal_reflect_NativeConstructorAccessorImpl_newInstance0
eava_jdk_internal_reflect_NativeMethodAccessorImpl_invoke0
eava_jdk_internal_reflect_Reflection_areNestMates
eava_jdk_internal_reflect_Reflection_getCallerClass
eava_jdk_internal_reflect_Reflection_getClassAccessFlags
eava_jdk_internal_util_SystemProps_00024Raw_platformProperties
eava_jdk_internal_util_SystemProps_00024Raw_vmProperties
eava_jdk_internal_vm_VMSupport_getVMTemporaryDirectory
eava_jdk_internal_vm_VMSupport_initAgentProperties
eava_sun_io_Win32ErrorMode_setErrorMode
eava_sun_security_provider_NativeSeedGenerator_nativeGenerateSeed
eava_sun_util_locale_provider_HostLocaleProviderAdapterImpl_getAmPmStrings
eava_sun_util_locale_provider_HostLocaleProviderAdapterImpl_getCalendarDataValue
eava_sun_util_locale_provider_HostLocaleProviderAdapterImpl_getCalendarDisplayStrings
eava_sun_util_locale_provider_HostLocaleProviderAdapterImpl_getCalendarID
eava_sun_util_locale_provider_HostLocaleProviderAdapterImpl_getCurrencySymbol
eava_sun_util_locale_provider_HostLocaleProviderAdapterImpl_getDateTimePattern
eava_sun_util_locale_provider_HostLocaleProviderAdapterImpl_getDecimalSeparator
eava_sun_util_locale_provider_HostLocaleProviderAdapterImpl_getDefaultLocale
eava_sun_util_locale_provider_HostLocaleProviderAdapterImpl_getDisplayString
eava_sun_util_locale_provider_HostLocaleProviderAdapterImpl_getEras
eava_sun_util_locale_provider_HostLocaleProviderAdapterImpl_getGroupingSeparator
eava_sun_util_locale_provider_HostLocaleProviderAdapterImpl_getInfinity
eava_sun_util_locale_provider_HostLocaleProviderAdapterImpl_getInternationalCurrencySymbol
eava_sun_util_locale_provider_HostLocaleProviderAdapterImpl_getMinusSign
eava_sun_util_locale_provider_HostLocaleProviderAdapterImpl_getMonetaryDecimalSeparator
eava_sun_util_locale_provider_HostLocaleProviderAdapterImpl_getMonths
eava_sun_util_locale_provider_HostLocaleProviderAdapterImpl_getNaN
eava_sun_util_locale_provider_HostLocaleProviderAdapterImpl_getNumberPattern
eava_sun_util_locale_provider_HostLocaleProviderAdapterImpl_getPerMill
eava_sun_util_locale_provider_HostLocaleProviderAdapterImpl_getPercent
eava_sun_util_locale_provider_HostLocaleProviderAdapterImpl_getShortMonths
eava_sun_util_locale_provider_HostLocaleProviderAdapterImpl_getShortWeekdays
eava_sun_util_locale_provider_HostLocaleProviderAdapterImpl_getWeekdays
eava_sun_util_locale_provider_HostLocaleProviderAdapterImpl_getZeroDigit
eava_sun_util_locale_provider_HostLocaleProviderAdapterImpl_initialize
eava_sun_util_locale_provider_HostLocaleProviderAdapterImpl_isNativeDigit
eetEncodingFromLangID
eetErrorString
eetJavaIDFromLangID
eetLastErrorString
eetPrefixed
eandleLseek
eandleRead
eio_fprintf
init

Sections

.text
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 736B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e02e1c0c5705284295902a39046bed01

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

version

kernel32

Exports

Exports

Sections

.text Size: 82KB - Virtual size: 81KB

.rdata Size: 38KB - Virtual size: 38KB

.data Size: 5KB - Virtual size: 6KB

.pdata Size: 4KB - Virtual size: 3KB

.rsrc Size: 20KB - Virtual size: 16KB

.reloc Size: 1024B - Virtual size: 736B

.text
Size: 82KB - Virtual size: 81KB

.rdata
Size: 38KB - Virtual size: 38KB

.data
Size: 5KB - Virtual size: 6KB

.pdata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 20KB - Virtual size: 16KB

.reloc
Size: 1024B - Virtual size: 736B