3c981aa3816bc064b4e5b03cfbfb6a98 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3c981aa3816bc064b4e5b03cfbfb6a98
Size

507KB
MD5

3c981aa3816bc064b4e5b03cfbfb6a98
SHA1

f204f5413279a5248692d7bb01f0f72263fdeaef
SHA256

135d3dc7bc4f97f4d164abb4e048764c1393c585c2158452f16b050504c531a5
SHA512

ffcf5e27d5958e298adf6713fe4527ed3c3a9ae44bc1fc6fcd754f74325758892312c70252c8d2433fd55fff0b46700281830c5b57d398d173d74ed976bc083c
SSDEEP

12288:/HudgTuQxFfgqy5XSnlnL9bd7fTPA68Hrl3l8:/HEQXg9Z65bJUb3l8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3c981aa3816bc064b4e5b03cfbfb6a98

Files

3c981aa3816bc064b4e5b03cfbfb6a98
.dll regsvr32 windows:4 windows x86 arch:x86

51f4697869e0afc22f6d670cdfb0dac6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

oleaut32

SysFreeString

advapi32

RegQueryValueExA

user32

GetKeyboardType

gdi32

UnrealizeObject

version

VerQueryValueA

ole32

IsEqualGUID

comctl32

_TrackMouseEvent

urlmon

CoInternetCreateZoneManager

wininet

InternetSetOptionA

shell32

ShellExecuteExA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 492KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE