?classCCachedDataPathProperty@CCachedDataPathProperty@@2UCRuntimeClass@@B
?classCDataPathProperty@CDataPathProperty@@2UCRuntimeClass@@B
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Static task
static1
1 signatures
General
-
Target
mfco42d.dll
-
Size
780KB
-
MD5
21a2c7a5d4f6d647005f5fddc378db89
-
SHA1
ce02b020e9ca9e7a6dd8515b0abcf0f5dbf99cb2
-
SHA256
c24f04b2bdcd9211e49853ec874c6d5c1bc6487b09c378d185aa37cceea5c4c5
-
SHA512
872f442ce3642f4f7b536d33a2c854495b91df30cbe03f1c35cc23a048a89a1a48b724b858850079a2bdf0a30d80cd0c144718e7a92d775d669a039e0c3fee16
-
SSDEEP
12288:zzhf/HP2VTuOGJyUIgX3b3z4UnjXHPzm3H4KaA+Id5l9Ijpzn6F:zRv2AyUIs3ouLHrr2jlCF76F
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource mfco42d.dll
Files
-
mfco42d.dll.dll regsvr32 windows:4 windows x86
89b19682777306e83b39c6d1dc27f181
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mfc42d
ord800
ord1122
ord1168
ord4256
ord1172
ord768
ord5084
ord791
ord764
ord787
ord3382
ord2324
ord3355
ord2798
ord1417
ord2791
ord1094
ord3375
ord3166
ord3168
ord1882
ord1123
ord3305
ord795
ord799
ord880
ord3116
ord806
ord803
ord1947
ord1224
ord4492
ord2867
ord492
ord303
ord1786
ord4475
ord2994
ord1066
ord3392
ord2995
ord1120
ord1400
ord1161
ord2790
ord1490
ord2513
ord2448
ord3563
ord3065
ord4945
ord2269
ord797
ord2730
ord2447
ord3131
ord2794
ord4653
ord3133
ord1098
ord1782
ord3377
ord3308
ord877
ord878
ord454
ord2217
ord4170
ord1353
ord738
ord2044
ord2213
ord473
ord1582
ord2394
ord726
ord715
ord4814
ord4811
ord470
ord1124
ord2295
ord1038
ord1187
ord4658
ord464
ord342
ord714
ord673
ord1838
ord796
ord798
ord2397
ord4386
ord1996
ord1264
ord589
ord724
ord1126
ord1437
ord736
ord339
ord725
ord4195
ord3628
ord3947
ord4017
ord2550
ord3831
ord3362
ord1364
ord3651
ord4176
ord1781
ord4118
ord5076
ord3618
ord4208
ord2078
ord1310
ord1857
ord3069
ord3944
ord3670
ord2076
ord1566
ord5078
ord3002
ord4064
ord1344
ord4191
ord1830
ord1631
ord4205
ord2585
ord2684
ord3786
ord3658
ord1228
ord1112
ord1056
ord574
ord1135
ord2168
ord1163
ord4171
ord4197
ord705
ord527
ord3447
ord779
ord1174
ord487
ord488
ord1060
ord1862
ord309
ord1952
ord1839
ord1184
ord1113
ord2997
ord1395
ord1359
ord734
ord485
ord653
ord2389
ord3036
ord802
ord801
ord804
ord292
ord793
ord792
ord790
ord785
ord770
ord769
ord767
ord762
ord3193
ord4302
ord2640
ord945
ord2291
ord2419
ord1160
ord2114
ord4199
ord2411
ord2415
ord5058
ord1858
ord1876
ord1350
ord4304
ord2484
ord4387
ord3636
ord2753
ord2509
ord4749
ord3373
ord4901
ord2690
ord3785
ord644
ord582
ord3352
ord3353
ord411
ord328
ord2361
ord1024
ord4338
ord4753
ord2549
ord2729
ord2125
ord773
ord4420
ord1136
ord1079
ord3938
ord3950
ord1049
ord4000
ord3656
ord592
ord554
ord1509
ord290
ord1169
ord344
ord1232
ord1956
ord1387
ord1048
ord4268
ord1401
ord1185
ord1128
ord4231
ord2306
ord4586
ord3226
ord3378
ord422
ord4432
ord418
ord3335
ord1700
ord1009
ord4315
ord2103
ord1784
ord2412
ord4078
ord4081
ord3692
ord3575
ord2679
ord4021
ord973
ord2717
ord2223
ord2222
ord3429
ord4756
ord3361
ord1365
ord4210
ord2077
ord1309
ord3666
ord4183
ord2693
ord1969
ord2897
ord599
ord4351
ord354
ord1000
ord1045
ord3530
ord4174
ord3661
ord3565
ord3685
ord3710
ord1825
ord1845
ord4113
ord3419
ord450
ord2435
ord4433
ord1505
ord1152
ord4388
ord1567
ord4075
ord2345
ord3622
ord3677
ord1239
ord778
ord824
ord1181
ord4474
ord1140
ord805
ord1444
ord944
ord2293
ord4123
ord4651
ord2491
ord2495
ord2487
ord590
ord1085
ord4138
ord739
ord505
ord1236
ord1960
ord1409
ord830
ord3210
ord4952
ord474
ord3393
ord1080
ord3527
ord3203
ord4506
ord4951
ord4656
ord2627
ord5065
ord4948
ord1299
ord1711
ord2474
ord2420
ord4505
ord4782
ord2229
ord3360
ord2068
ord3252
ord1521
ord4541
ord633
ord1610
ord399
ord3403
ord3554
ord2127
ord1099
ord1096
ord958
ord1082
ord2746
ord2507
ord3660
ord2851
ord3300
ord1808
ord2678
ord1077
ord4036
ord3523
ord3758
ord3972
ord3730
ord4068
ord3611
ord3616
ord3729
ord3739
ord3738
ord3726
ord3728
ord3725
ord4004
ord4002
ord4175
ord4216
ord3001
ord1343
ord3664
ord332
ord316
ord314
ord4181
ord1116
ord4764
ord1886
ord2586
ord4757
ord4643
ord3406
ord3689
ord3836
ord2046
ord4934
ord4874
ord1640
ord1724
ord4875
ord3309
ord4975
ord4976
ord1411
ord4266
ord5094
ord2483
ord2159
ord2177
ord978
ord3037
ord1884
ord2423
ord3306
ord4736
ord836
ord4318
ord3021
ord959
ord1356
ord3369
ord4785
ord4150
ord1500
ord5021
ord4841
ord3716
ord1144
ord1089
ord350
ord4151
ord3845
ord1358
ord4840
ord3022
ord1354
ord3028
ord2789
ord4843
ord4781
ord3573
ord3598
ord3201
ord3170
ord1504
ord2313
ord1596
ord347
ord2145
ord3032
ord4385
ord3207
ord4382
ord2842
ord4383
ord2503
ord4440
ord3492
ord3495
ord2141
ord3386
ord2757
ord2153
ord1226
ord1950
ord2723
ord4751
ord453
ord3102
ord1393
ord273
ord546
ord1138
ord723
ord3465
ord4514
ord4332
ord1983
ord1251
ord2917
ord384
ord621
ord1071
ord506
ord2246
ord2716
ord2024
msvcrtd
__CxxFrameHandler
_adjust_fdiv
_malloc_dbg
_initterm
_free_dbg
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_except_handler3
_onexit
__dllonexit
_mbsrchr
wcsncpy
wcscpy
_vsnprintf
_ltoa
_ultoa
_ismbcspace
_ismbcdigit
strtol
strtoul
malloc
swprintf
_itoa
modf
strftime
localtime
time
ceil
fabs
floor
labs
_ftol
_mbschr
realloc
_strdup
free
_purecall
_mbctype
memset
wcslen
memcpy
_CxxThrowException
_CrtDbgReport
memcmp
_mbsinc
atol
memmove
_mbsnbcmp
kernel32
WideCharToMultiByte
lstrlenA
GetTickCount
lstrlenW
LocalAlloc
LocalFree
LoadLibraryA
FreeLibrary
GlobalFree
GetModuleHandleA
GlobalLock
GlobalAlloc
GlobalUnlock
InterlockedIncrement
lstrcmpiA
InterlockedDecrement
FileTimeToSystemTime
GetLastError
lstrcpynA
GetProfileIntA
GetCurrentThreadId
FileTimeToLocalFileTime
FormatMessageA
GlobalSize
lstrcmpA
MulDiv
lstrcatA
CopyFileA
FreeResource
LockResource
GetModuleFileNameA
FindResourceA
GetThreadLocale
LoadResource
lstrcpyW
GetUserDefaultLCID
OutputDebugStringA
lstrcpyA
GetVersion
IsDBCSLeadByte
GetProcAddress
InterlockedExchange
MultiByteToWideChar
RaiseException
gdi32
DPtoLP
CopyMetaFileA
CreateDCA
GetDeviceCaps
DeleteMetaFile
DeleteDC
ScaleWindowExtEx
LPtoDP
SetMapMode
SelectObject
GetPaletteEntries
CreatePalette
EnumFontFamiliesA
user32
CopyAcceleratorTableA
IsWindow
CopyRect
IsClipboardFormatAvailable
SendMessageA
EnableWindow
wsprintfA
GetActiveWindow
InSendMessage
ReleaseCapture
PeekMessageA
GetKeyState
GetCursorPos
DispatchMessageA
PostThreadMessageA
GetWindowTextA
GetWindowTextLengthA
IsMenu
GetMenuItemID
InsertMenuA
AppendMenuA
GetMenuStringA
GetMenuState
GetSubMenu
GetMenuItemCount
RemoveMenu
ReleaseDC
WindowFromDC
GetDC
IsRectEmpty
SetScrollRange
SetFocus
GetParent
GetFocus
DestroyIcon
RegisterWindowMessageA
CountClipboardFormats
GetSystemMetrics
RegisterClipboardFormatA
GetWindowLongA
AdjustWindowRectEx
SetWindowContextHelpId
GetWindow
SetWindowPos
MapDialogRect
GetDlgItem
CharNextA
IsWindowVisible
IsDialogMessageA
GetDlgCtrlID
ClipCursor
InflateRect
DestroyWindow
SetWindowLongA
DefWindowProcA
CallWindowProcA
SetParent
DrawEdge
ShowWindow
GetWindowRect
GetMenu
GetDesktopWindow
PostMessageA
GetClassNameA
IsChild
IntersectRect
ScreenToClient
MessageBoxA
EnumChildWindows
LockWindowUpdate
GetSysColor
SetCursor
LoadCursorA
PtInRect
SetRectEmpty
OffsetRect
GetDialogBaseUnits
MessageBeep
DestroyMenu
CreateMenu
Exports
Exports
Sections
.text Size: 564KB - Virtual size: 563KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 140KB - Virtual size: 137KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 48KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ