29f5d9b5cd66c9e7614130bf1acca06d | Triage

Sharing

General

Target

29f5d9b5cd66c9e7614130bf1acca06d
Size

509KB
MD5

29f5d9b5cd66c9e7614130bf1acca06d
SHA1

1bcb097e8218447db876fdca9ade5d7fd541587e
SHA256

3a875c92372d9e8bf522ec79fa97c0a2d93957116978ebc319cbc99fbc0839ae
SHA512

353b51ad25b26be0e316e17fa1a66921ccded832a9376346795ea0d02a2cc36d2362486a82373da2c96e3549e582e3e7ca5f05c4e1acf556fb706f378725cf53
SSDEEP

12288:YCkBuHsZfYLyB9SqoKumDXh1al+hte5+tAL7LwOJ50UWpGtJxK:7HnqoKpXLaUygKPwob

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
29f5d9b5cd66c9e7614130bf1acca06d

Files

29f5d9b5cd66c9e7614130bf1acca06d
.exe regsvr32 windows:5 windows x86 arch:x86

0021f47781268b6caaf314d0b686997c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

kernel32

ExitProcess
FreeLibrary
GetModuleHandleW
GetVersionExW
lstrcmpiA
GetProcAddress
DeleteFileA
VirtualProtect
GetCurrentProcess
GetCurrentThreadId
GetTickCount
lstrcpyW
lstrlenW

user32

wsprintfW

Exports

Exports

CPlApplet
DllCanUnloadNow
DllGetClassObject
DllGetClassObjectEx
DllRegisterServer
DllRegisterServerEx
DllUnregisterServer
DllUnregisterServerEx

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 326B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.stub
Size: 500KB - Virtual size: 500KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE