5d773e734290b93649a41ccda63772560b4fa25ba715b17df7b9f18883679160[.]xll

Sharing

Copy URL Twitter E-mail

General

Target

5d773e734290b93649a41ccda63772560b4fa25ba715b17df7b9f18883679160.xll
Size

578KB
MD5

89f7d22009ba38b71aaa23db348e2ee1
SHA1

2f1fba74aece779c290e7e100fc2080a5681ea44
SHA256

5d773e734290b93649a41ccda63772560b4fa25ba715b17df7b9f18883679160
SHA512

2f93827344a48b26c981bdf6b161625aebed336e7924ead5446a2aad59de9d739f47efc86a9390f56c835428c34162454bddcd2e473cf8c5a5c08cb9991eef2c
SSDEEP

12288:F/13yKvW/ah67GsCQ9v8g0aHj8jjVwmhc:f3+/aACQ9p0aDb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5d773e734290b93649a41ccda63772560b4fa25ba715b17df7b9f18883679160.xll

Files

5d773e734290b93649a41ccda63772560b4fa25ba715b17df7b9f18883679160.xll
.xll windows x64

02deada508bc7e5d3aef09c3ece43305

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GetProcAddress
CopyFileA
GetModuleHandleA
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent

advapi32

RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA

shell32

ShellExecuteA

vcruntime140

__C_specific_handler
__std_type_info_destroy_list
memcpy
memset

api-ms-win-crt-stdio-l1-1-0

fwrite
fclose
fopen

api-ms-win-crt-heap-l1-1-0

malloc
free

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table
_cexit
_initterm
_initialize_onexit_table
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initialize_narrow_environment

api-ms-win-crt-string-l1-1-0

_stricmp

api-ms-win-crt-filesystem-l1-1-0

_mkdir

Exports

Exports

xlAutoOpen

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 563KB - Virtual size: 562KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 232B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 680B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

02deada508bc7e5d3aef09c3ece43305

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

shell32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

Exports

Exports

Sections

.text Size: 12KB - Virtual size: 11KB

.rdata Size: 563KB - Virtual size: 562KB

.data Size: 512B - Virtual size: 232B

.pdata Size: 512B - Virtual size: 480B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 1024B - Virtual size: 680B

.text
Size: 12KB - Virtual size: 11KB

.rdata
Size: 563KB - Virtual size: 562KB

.data
Size: 512B - Virtual size: 232B

.pdata
Size: 512B - Virtual size: 480B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 1024B - Virtual size: 680B