ba1338af1c2b2202943d54fe44835e332a9d463328e0623b3012d869f6669651

Sharing

Copy URL Twitter E-mail

General

Target

ba1338af1c2b2202943d54fe44835e332a9d463328e0623b3012d869f6669651
Size

1.2MB
MD5

bab17c43027e8410c540a0564e19b760
SHA1

c74046125d87d1f72f5429a5d458f24cf82f2604
SHA256

ba1338af1c2b2202943d54fe44835e332a9d463328e0623b3012d869f6669651
SHA512

06e07c16c95fe60ae18f62bf7b590d1c7d9ff53c057d8507a871eb7b7f84b0adc1680be4ac08bf78da7fde28fdfb041585f60c88038a600cee9964510910c6fd
SSDEEP

24576:6MxKdRECGfvGf8lX3uNGavkg3Ny5rbbTyLrBAUZLYM:6M8l++SX3uNGaXuaLrBAUZLYM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ba1338af1c2b2202943d54fe44835e332a9d463328e0623b3012d869f6669651

Files

ba1338af1c2b2202943d54fe44835e332a9d463328e0623b3012d869f6669651
.dll regsvr32 windows x64

b9eaafaf9b47ce869fb349abf81438c3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

SetFilePointer
SetEndOfFile
ReadFile
WriteFile
FlushFileBuffers
LoadLibraryW
GetTempPathW
GetTickCount
GetDriveTypeW
WaitForSingleObject
GetPrivateProfileStringW
InitializeCriticalSection
TerminateProcess
GetCurrentProcess
CreateFileW
CreateThread
GetExitCodeThread
GetCurrentProcessId
GetCurrentDirectoryW
GetCurrentThreadId
HeapFree
HeapAlloc
GetProcessHeap
SetEvent
OpenEventW
CreateEventW
WideCharToMultiByte
MapViewOfFile
UnmapViewOfFile
FlushViewOfFile
CreateFileMappingW
OpenFileMappingW
GetACP
CompareStringW
WriteConsoleW
SetStdHandle
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
PeekNamedPipe
GetFileInformationByHandle
GetFullPathNameW
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetStartupInfoW
CloseHandle
GetVersionExW
MoveFileExW
WritePrivateProfileStringW
DeleteFileW
GetFileAttributesW
FindClose
GetThreadLocale
SetThreadLocale
LocalFree
LeaveCriticalSection
EnterCriticalSection
GetModuleFileNameW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
FreeLibrary
lstrcmpiW
GetModuleHandleW
GetProcAddress
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
RaiseException
lstrlenW
GetTempFileNameW
GetComputerNameA
Sleep
GetFileType
SetHandleCount
HeapReAlloc
HeapDestroy
HeapCreate
GetVersion
HeapSetInformation
GetStringTypeW
ExitProcess
HeapSize
GetStdHandle
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LCMapStringW
IsValidCodePage
GetOEMCP
FlsAlloc
SetLastError
FlsFree
FlsGetValue
GetCPInfo
FindFirstFileExW
FileTimeToLocalFileTime
FileTimeToSystemTime
GetCommandLineA
FlsSetValue
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
RtlPcToFileHeader
RtlUnwindEx
RtlLookupFunctionEntry
SetEnvironmentVariableA

user32

SendMessageW
FindWindowW
CharNextW

advapi32

RegCreateKeyExW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetNamedSecurityInfoA
BuildExplicitAccessWithNameW
SetEntriesInAclW
SetNamedSecurityInfoA
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyExW

ole32

CoTaskMemRealloc
CoTaskMemFree
StringFromGUID2
CoCreateInstance
CoTaskMemAlloc

oleaut32

SysFreeString
VariantInit
VariantClear
SysAllocString
VarUI4FromStr
SysStringLen
LoadRegTypeLi
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 269KB - Virtual size: 268KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 894KB - Virtual size: 894KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b9eaafaf9b47ce869fb349abf81438c3

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 269KB - Virtual size: 268KB

.rdata Size: 894KB - Virtual size: 894KB

.data Size: 8KB - Virtual size: 17KB

.pdata Size: 13KB - Virtual size: 12KB

.rsrc Size: 12KB - Virtual size: 12KB

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 269KB - Virtual size: 268KB

.rdata
Size: 894KB - Virtual size: 894KB

.data
Size: 8KB - Virtual size: 17KB

.pdata
Size: 13KB - Virtual size: 12KB

.rsrc
Size: 12KB - Virtual size: 12KB

.reloc
Size: 5KB - Virtual size: 4KB