0c09ecde8116e303bec288855c1301bc

Sharing

Copy URL Twitter E-mail

General

Target

0c09ecde8116e303bec288855c1301bc
Size

41KB
MD5

0c09ecde8116e303bec288855c1301bc
SHA1

330ec0cc767270450ef4ed2af3c33ecf6037257c
SHA256

7b96a147700d0ee48d0fc7a74330272b7f934c7e7c85ab0bbd723937bd0e566e
SHA512

068690130480f4d6304c3e2b28406c00102c55007d6ba3b2b8ba5c729cdf383ca794db10bd7ccd9d1aa33c64267141ab6917fd68c5aea27dfb31ac772510c60d
SSDEEP

768:i4TrL1xJddyW9QGPW1pVHkmTHzHtCo9cQDbUGTV:ia/JGUQGPWhEmTHzHAoqQDbUGTV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0c09ecde8116e303bec288855c1301bc

Files

0c09ecde8116e303bec288855c1301bc
.dll regsvr32 windows:4 windows x86 arch:x86

1ff4c4c142ea70fe689c30e8a09d2f14

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InterlockedIncrement
InitializeCriticalSection
DisableThreadLibraryCalls
GetModuleFileNameA
IsBadCodePtr
LoadLibraryA
GetProcAddress
GetCurrentThreadId
MultiByteToWideChar
lstrlenW
WideCharToMultiByte
GetSystemDirectoryA
InterlockedDecrement
RtlUnwind
GetStringTypeW
GetStringTypeA
SetUnhandledExceptionFilter
WriteFile
GetEnvironmentStringsW
GetEnvironmentStrings
LocalFree
Sleep
InterlockedExchange
HeapAlloc
GetCommandLineA
GetVersion
RaiseException
HeapFree
ExitProcess
TerminateProcess
GetCurrentProcess
HeapReAlloc
HeapSize
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
GetCPInfo
GetACP
GetOEMCP
LCMapStringA
LCMapStringW
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW

atl

ord58
ord32
ord57
ord18
ord15
ord16
ord21
ord30
ord31
ord23

user32

MessageBoxA
wsprintfA
CharUpperA

advapi32

RegCreateKeyExA
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
RegEnumValueA

oleaut32

SysStringLen
LoadRegTypeLi
SysAllocStringLen
VariantInit
VariantClear
SysFreeString

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 3KB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1ff4c4c142ea70fe689c30e8a09d2f14

Headers

File Characteristics

Imports

kernel32

atl

user32

advapi32

oleaut32

Exports

Exports

Sections

.text Size: 26KB - Virtual size: 25KB

.data Size: 3KB - Virtual size: 2.0MB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 7KB - Virtual size: 7KB

.text
Size: 26KB - Virtual size: 25KB

.data
Size: 3KB - Virtual size: 2.0MB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 7KB - Virtual size: 7KB