51932997a0de4d91595bd7d718827775

Sharing

Copy URL Twitter E-mail

General

Target

51932997a0de4d91595bd7d718827775
Size

58KB
MD5

51932997a0de4d91595bd7d718827775
SHA1

a05a239f27eecb052fcad3983ec4d0d6b891e02f
SHA256

eaac67d22ce77c78e15a9e3cf7bbb557fc59280745df470ef155acfe5e7310f1
SHA512

b7fefb90cbf0002747becff3376f1b61b1856efc75d998d86ce633f968e5f0fe7cdbeed1d38f8b55ddc19d19bec1ea5c608769a0649c7f30931782eaa21038da
SSDEEP

768:2ZgNxu6+69u7jNxPlp1B2423//tGJpiDSRcJ8unXIqtDAqpeF7U7:PSs9QRxPlp/29/tR8nqpbpeF47

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
51932997a0de4d91595bd7d718827775

Files

51932997a0de4d91595bd7d718827775
.dll regsvr32 windows:6 windows x86 arch:x86

900b593c35c32d35babe3050ba7c4877

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

memcpy
free
malloc
_except_handler3
rand
??2@YAPAXI@Z
??3@YAXPAX@Z
sprintf
atol
_vsnprintf
strncpy
strchr
srand
toupper
_wcsicmp
_stricmp
_strnicmp
memset
towlower
_vsnwprintf
_wcsnicmp

ntdll

RtlUnwind

kernel32

HeapFree
GetProcessHeap
HeapAlloc
EnterCriticalSection
InitializeCriticalSection
WideCharToMultiByte
CreateRemoteThread
LoadLibraryW
LeaveCriticalSection
SetUnhandledExceptionFilter
InterlockedExchange
UnhandledExceptionFilter
TerminateProcess
InterlockedDecrement
GetSystemDirectoryA
DisableThreadLibraryCalls
GetModuleFileNameA
CreateFileA
GetFileSize
ReadFile
GetModuleFileNameW
ProcessIdToSessionId
VirtualProtectEx
CreateFileW
CallNamedPipeW
SetErrorMode
GetCurrentProcess
VirtualAllocEx
GetCurrentProcessId
GetCurrentThreadId
GetCurrentThread
Sleep
GetTickCount
OutputDebugStringA
GetProcAddress
GetModuleHandleW
InterlockedIncrement
GetSystemInfo
CloseHandle
CreateThread
WaitForSingleObject
CreateProcessW
QueryPerformanceCounter
GetModuleHandleA
OpenProcess
WriteProcessMemory

user32

InsertMenuW
RegisterWindowMessageA
UnhookWinEvent
GetClassNameA
GetMessageW
TranslateMessage
DispatchMessageW
GetClassNameW
GetAncestor
GetWindowThreadProcessId
MessageBoxW
SetWinEventHook
SetWindowsHookExW
SetWindowsHookExA
ExitWindowsEx
PostThreadMessageW
PostThreadMessageA
PostMessageW
PostMessageA
SendMessageCallbackW
SendMessageCallbackA
SendMessageTimeoutW
SendMessageTimeoutA
SendNotifyMessageW
SendNotifyMessageA
SendMessageW
SendMessageA
CreateWindowExW
CreateWindowExA
SetWindowTextA
SetWindowTextW
DrawTextExW
MessageBeep
SetClipboardData
GetClipboardData
MessageBoxA
ShowWindow
SetWindowPos
GetWindowRect
GetWindowInfo
GetWindowLongW
GetWindowPlacement
GetWindow

shell32

DragQueryFileW
ord182

ole32

CoCreateInstanceEx
CoInitializeEx
CoGetClassObject

advapi32

CreateServiceW
OpenServiceW
OpenServiceA
OpenSCManagerW
OpenSCManagerA
DeleteService
ControlService
StartServiceW
StartServiceA
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
GetUserNameW
CreateServiceA

psapi

GetModuleFileNameExW
GetModuleInformation

urlmon

URLDownloadToFileA
URLDownloadToFileW

wininet

InternetOpenA
InternetOpenUrlA
InternetCloseHandle

oleacc

AccessibleObjectFromEvent

rpcrt4

NdrSendReceive
I_RpcSend
I_RpcSendReceive

oleaut32

SysFreeString

shlwapi

UrlIsW

gdi32

StretchBlt
PlgBlt
TextOutW
MaskBlt
BitBlt
CreateDCA
CreateDCW

msimg32

AlphaBlend
TransparentBlt

shdocvw

AddUrlToFavorites

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
SynExp
SynProc
SynProc2

Sections

.text
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

900b593c35c32d35babe3050ba7c4877

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

kernel32

user32

shell32

ole32

advapi32

psapi

urlmon

wininet

oleacc

rpcrt4

oleaut32

shlwapi

gdi32

msimg32

shdocvw

Exports

Exports

Sections

.text Size: 37KB - Virtual size: 36KB

.data Size: 6KB - Virtual size: 22KB

.rsrc Size: 7KB - Virtual size: 7KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 37KB - Virtual size: 36KB

.data
Size: 6KB - Virtual size: 22KB

.rsrc
Size: 7KB - Virtual size: 7KB

.reloc
Size: 6KB - Virtual size: 5KB