ironwind[.]xll

Sharing

Copy URL Twitter E-mail

General

Target

ironwind.xll
Size

571KB
MD5

88915eb58dc887d639845f3812338534
SHA1

06424f103c1dc7258e061990cdab1a6b84602160
SHA256

9b2a16cbe5af12b486d31b68ef397d6bc48b2736e6b388ad8895b588f1831f47
SHA512

36ca5191652743999ae79052ff6164d6a9b7ee6ac5f30d1d12f36e87492212280f7520883532656233cf70fbd46c851806a1ed4e67e3c45e18ced8124e035882
SSDEEP

12288:2C/hXSqv2/6BabGMiw9PcA0YlxuHD8DjVQp81:2IXe/6Aiw9J0Ylxuj2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ironwind.xll

Files

ironwind.xll
.xll windows:6 windows x86

8f92a7675ef20749a23637d3c6b1696e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcAddress
CopyFileA
GetModuleHandleA
GetCurrentProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess

advapi32

RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA

shell32

ShellExecuteA

vcruntime140

_except_handler4_common
memset
__std_type_info_destroy_list

api-ms-win-crt-stdio-l1-1-0

fclose
fwrite
fopen

api-ms-win-crt-heap-l1-1-0

free
malloc

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table
_configure_narrow_argv
_initialize_onexit_table
_initialize_narrow_environment
_seh_filter_dll
_initterm_e
_initterm
_cexit

api-ms-win-crt-string-l1-1-0

_stricmp

api-ms-win-crt-filesystem-l1-1-0

_mkdir

Exports

Exports

xlAutoOpen

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 558KB - Virtual size: 558KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8f92a7675ef20749a23637d3c6b1696e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

shell32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 8KB

.rdata Size: 558KB - Virtual size: 558KB

.data Size: 512B - Virtual size: 928B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 8KB - Virtual size: 8KB

.rdata
Size: 558KB - Virtual size: 558KB

.data
Size: 512B - Virtual size: 928B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 2KB - Virtual size: 1KB