b64-2-xord.dll
- IMPHASH 39a613f0d59cc3ef3bbadfe701521e7c
- SHA256 7ad79f28a7e10df617a55f85d379949f65fa30770966d889d899c94734e24cca
-
Unsigned PE
Checks for missing Authenticode signature.
Behavioral task
behavioral1
Sample
b64-2-xord.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
b64-2-xord.dll
Resource
win10v2004-20230703-en
cobaltstrike
2126429048
http://67.207.93.135:80/metro91/admin/1/ppptp.jpg
512
67.207.93.135,/metro91/admin/1/ppptp.jpg
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAARQ29ubmVjdGlvbjogQ2xvc2UAAAAQAAAAHkhvc3Q6IG1haGFtYXlhMWlmZXNjaWVuY2VzLmNvbQAAAAoAAAAXQ2FjaGUtQ29udHJvbDogbm8tY2FjaGUAAAAHAAAAAAAAAAMAAAAGAAAABkNvb2tpZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29ubmVjdGlvbjogS2VlcC1BbGl2ZQAAABAAAAAeSG9zdDogbWFoYW1heWExaWZlc2NpZW5jZXMuY29tAAAACgAAABdDYWNoZS1Db250cm9sOiBuby1jYWNoZQAAAAcAAAAAAAAACAAAAAUAAAACaWQAAAAHAAAAAQAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
GET
POST
1280
255
30000
80
%windir%\syswow64\rundll32.exe
%windir%\sysnative\rundll32.exe
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDVEWupXLqhGMw+U/ChoDycqpf3CqF4PfAxC6Gs7HpoYtM2UIDS2rAO7hTYnCVRSWh0LTBqpQ1RHyNgfK8tBDsBQ8yEp5yxZYj0BWqGlIlSi0OG/x1JhZa41C0DlSElY2LyXLB3c/RuyQKHv+arhulVDrdAuIhGVQt0C4PghQu8IQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
4096
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
/metro91/admin/1/secure.php
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)
2126429048
Checks for missing Authenticode signature.
| resource |
|---|
| b64-2-xord.dll |
Unsigned PE
Checks for missing Authenticode signature.