315931472974cbc144977eca4ca50c98 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

315931472974cbc144977eca4ca50c98
Size

101KB
MD5

315931472974cbc144977eca4ca50c98
SHA1

2c6e691f041284aae8f8c9532e2778de249aa709
SHA256

c6f72450c1911c18e3e72a02e0e8fff56275a04443420e2621d3c3458122a31d
SHA512

4c05726ce1365edf4c09b83b5a53dcf5ff85ff2911a310f7ea0fa56e134e2b87112f6d68d0cef24d478a27990e6d1d75755ee87d9be00be31ebbb75405355274
SSDEEP

3072:iJgNe8I+CQXOogqfKyGK3hyvwlS7YGTKv2DsotATz:iJgNe8JCQXyqfHHgb7lTKO4otA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
315931472974cbc144977eca4ca50c98

Files

315931472974cbc144977eca4ca50c98
.dll regsvr32 windows:4 windows x86 arch:x86

4da8f0fd185f6674697fb629ce501157

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

Toolhelp32ReadProcessMemory
GetProcAddress
OpenSemaphoreA
HeapWalk
LoadLibraryExA
SetDefaultCommConfigW

advapi32

FreeSid

oleaut32

SysFreeString

user32

wvsprintfA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
Cokngcp
DllMain
DllRegisterServer
DllUnregisterServer
ServiceMain

Sections

.text
Size: 97KB - Virtual size: 268KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 418B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 224B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_MEM_READ