0075654713043762382946dc4dea5b8e3ccf3d9ff933b2282c5257d9ff2c994d

Sharing

Copy URL Twitter E-mail

General

Target

0075654713043762382946dc4dea5b8e3ccf3d9ff933b2282c5257d9ff2c994d
Size

499KB
MD5

361258531505d3954f4aff74d6b9385e
SHA1

7708d6ecc123e01718b58ac762e263045689a260
SHA256

0075654713043762382946dc4dea5b8e3ccf3d9ff933b2282c5257d9ff2c994d
SHA512

8c2ce2b0c045ce7f5f32e0c88ac1f54e5c0d83524f3aba373dcb22a3f564ffe10eb0a0bc0424ad212b9113028cf72c831827620d45ee1c616ea0af6e8aad4e05
SSDEEP

12288:ut/A1VBhW8GvdttH98Cv0mCB45kjJXiN9ca:L3BhW8GpH9jNCB45kBiIa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0075654713043762382946dc4dea5b8e3ccf3d9ff933b2282c5257d9ff2c994d

Files

0075654713043762382946dc4dea5b8e3ccf3d9ff933b2282c5257d9ff2c994d
.dll windows x86

bd7f2d05f6fe05876c40a672b761657d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

libgcc_s_dw2-1

__emutls_get_address

kernel32

DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetCurrentProcess
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
InitializeCriticalSection
IsDBCSLeadByteEx
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
Sleep
TerminateProcess
TlsGetValue
VirtualProtect
VirtualQuery
WideCharToMultiByte

msvcrt

__mb_cur_max
__setusermatherr
_amsg_exit
_assert
_errno
_findclose
_getpid
_initterm
_iob
_lock
_setjmp3
_snprintf_s
_strdup
_stricmp
_unlock
_wfindfirst64
_wfindnext64
_wfopen
_wmkdir
_wremove
_wrename
_write
_wstat64
abort
atof
atoi
calloc
exit
fclose
fflush
fputc
fread
free
fseek
ftell
fwrite
getenv
localeconv
longjmp
malloc
memcpy
memmove
memset
memcmp
qsort
realloc
rewind
setlocale
signal
strchr
strcmp
strcpy
strerror
strlen
strncmp
strrchr
strstr
strtol
system
time
vfprintf
wcslen

ole32

CoTaskMemFree

shell32

SHGetKnownFolderPath

liblcms2-2

cmsCloseProfile
cmsCreateTransform
cmsDoTransform
cmsOpenProfileFromMem

Exports

Exports

babl_backtrack
babl_chromatic_adaptation_matrix
babl_class_name
babl_component
babl_component_new
babl_conversion_class_for_each
babl_conversion_get_destination_space
babl_conversion_get_source_space
babl_conversion_new
babl_cpu_accel_get_support
babl_db_each
babl_db_exist_by_id
babl_db_exist_by_name
babl_db_find
babl_db_init
babl_exit
babl_extender
babl_extension_quiet_log
babl_fast_fish
babl_fish
babl_fish_db
babl_fish_get_process
babl_fish_path
babl_format
babl_format_class_for_each
babl_format_exists
babl_format_get_bytes_per_pixel
babl_format_get_encoding
babl_format_get_model
babl_format_get_n_components
babl_format_get_space
babl_format_get_type
babl_format_has_alpha
babl_format_is_format_n
babl_format_is_palette
babl_format_n
babl_format_new
babl_format_with_space
babl_formats_count
babl_free
babl_gc
babl_get_model_flags
babl_get_name
babl_get_user_data
babl_get_version
babl_icc_get_key
babl_icc_make_space
babl_init
babl_introspect
babl_malloc
babl_model
babl_model_class_for_each
babl_model_is
babl_model_is_symmetric
babl_model_new
babl_model_with_space
babl_new_palette
babl_new_palette_with_space
babl_palette_reset
babl_palette_set_palette
babl_polynomial_approximate_gamma
babl_process
babl_process_rows
babl_sampling
babl_sanity
babl_set_extender
babl_set_user_data
babl_space
babl_space_from_chromaticities
babl_space_from_icc
babl_space_from_rgbxyz_matrix
babl_space_from_xyz
babl_space_get
babl_space_get_gamma
babl_space_get_icc
babl_space_get_rgb_luminance
babl_space_get_rgbtoxyz
babl_space_is_cmyk
babl_space_is_gray
babl_space_to_icc
babl_space_to_xyz
babl_space_with_trc
babl_ticks
babl_trc
babl_trc_gamma
babl_type
babl_type_class_for_each
babl_type_is_symmetric
babl_type_new

Sections

.text
Size: 247KB - Virtual size: 247KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 272B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 197KB - Virtual size: 196KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 627KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bd7f2d05f6fe05876c40a672b761657d

Headers

DLL Characteristics

File Characteristics

Imports

libgcc_s_dw2-1

kernel32

msvcrt

ole32

shell32

liblcms2-2

Exports

Exports

Sections

.text Size: 247KB - Virtual size: 247KB

.data Size: 512B - Virtual size: 272B

.rdata Size: 197KB - Virtual size: 196KB

/4 Size: 32KB - Virtual size: 31KB

.bss Size: - Virtual size: 627KB

.edata Size: 3KB - Virtual size: 2KB

.idata Size: 3KB - Virtual size: 2KB

.CRT Size: 512B - Virtual size: 44B

.tls Size: 512B - Virtual size: 8B

.reloc Size: 11KB - Virtual size: 10KB

.text
Size: 247KB - Virtual size: 247KB

.data
Size: 512B - Virtual size: 272B

.rdata
Size: 197KB - Virtual size: 196KB

/4
Size: 32KB - Virtual size: 31KB

.bss
Size: - Virtual size: 627KB

.edata
Size: 3KB - Virtual size: 2KB

.idata
Size: 3KB - Virtual size: 2KB

.CRT
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 8B

.reloc
Size: 11KB - Virtual size: 10KB