20c2209cdc51d9cdf854df4199b76559 | Triage

Sharing

General

Target

20c2209cdc51d9cdf854df4199b76559
Size

147KB
MD5

20c2209cdc51d9cdf854df4199b76559
SHA1

c5e950427913c897e71288aea9cdec67641f7947
SHA256

37d122bfcba29722a0a335c8a5df976170f37f0ef64da11c5d9160cb4ce0df84
SHA512

9b04b49e6ad2a1792928b26f3ed9ab63068c9b0752504694214ce1857a70c7329f89609e45c9c5348232760a1dd9f07d07df08270ee8673243701c67edaffe76
SSDEEP

1536:20qReVC/6PBpOQns6FCaScxVZFei/4fCUun8yOCabCnO07qU8SM+e5ML+bdIAKWh:DIuZ86FbpPZH/4f4sCnna8eRdto9CW9i

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
20c2209cdc51d9cdf854df4199b76559

Files

20c2209cdc51d9cdf854df4199b76559
.dll regsvr32 windows:4 windows x86 arch:x86

bc33e0d58c61198dfaa558558dad22f1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

CharNextA

advapi32

OpenProcessToken

shell32

SHGetFileInfoA

ole32

StringFromGUID2

oleaut32

SysFreeString

shlwapi

PathFindExtensionA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 39KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE