69ee3dcb009b2b73caaed537fcb5be92

Sharing

Copy URL

Twitter E-mail

General

Target

69ee3dcb009b2b73caaed537fcb5be92
Size

56KB
MD5

69ee3dcb009b2b73caaed537fcb5be92
SHA1

faea642c0e4ce4a0544996c0b74148f1f15ae0bf
SHA256

dc9e53941a5ab8749bdc868cf821e13d95ca18d978c60ec58e055fc1dde123f7
SHA512

6ed90d988f30a17b01b938b31df24680302dcda751470105b376b4c1c0db2e4c193ea520c6cdfbc0ba8d7841240384ad8bbdcdaca3f0ee230a4c7be010f87db0
SSDEEP

1536:WS5ybsS0u3seslBbYLPn6UlODGYH0KEnqPT+vl:WS5CN8/uybGreTyl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
69ee3dcb009b2b73caaed537fcb5be92

Files

69ee3dcb009b2b73caaed537fcb5be92
.dll regsvr32 windows:4 windows x86 arch:x86

6bcab36d6905bd3cabbaad0efa3e6584

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
CreateProcessA
GetSystemDirectoryA
Sleep
GetExitCodeProcess
WaitForSingleObject
GetProcAddress
LoadLibraryA
CreateDirectoryA
DeleteFileA
Process32Next
Process32First
FreeLibrary
GetModuleFileNameA
WideCharToMultiByte
ExitProcess
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
SetFileAttributesA
WritePrivateProfileStringA
CreateThread
MoveFileA
GetCurrentProcessId
GetModuleHandleA
GetShortPathNameA
lstrlenA
MultiByteToWideChar
lstrlenW
HeapDestroy
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
LocalFree
GetCommandLineW

advapi32

RegSetValueExA
RegEnumKeyExA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegQueryInfoKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegDeleteKeyA
RegCreateKeyExA

shell32

CommandLineToArgvW
SHGetSpecialFolderPathA

ole32

CoUninitialize
CoInitialize
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoCreateInstance

oleaut32

VariantClear
SysAllocString
SysStringLen
LoadRegTypeLi
SysFreeString

msvcrt

strlen
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
strncmp
strncpy
strcmp
strchr
atoi
strrchr
fopen
fseek
ftell
memcpy
_purecall
??3@YAXPAX@Z
??2@YAPAXI@Z
memcmp
strstr
wcsstr
_wcslwr
sprintf
memset
_strupr
strcat
strcpy
_access
fclose
fread

shlwapi

SHDeleteValueA
SHDeleteKeyA
SHSetValueA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

bdata
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

idata
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6bcab36d6905bd3cabbaad0efa3e6584

Headers

File Characteristics

Imports

kernel32

advapi32

shell32

ole32

oleaut32

msvcrt

shlwapi

Exports

Exports

Sections

.text Size: 28KB - Virtual size: 27KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 4KB - Virtual size: 3KB

bdata Size: 4KB - Virtual size: 4B

idata Size: 4KB - Virtual size: 4B

.rsrc Size: 4KB - Virtual size: 2KB

.reloc Size: 4KB - Virtual size: 1KB

.text
Size: 28KB - Virtual size: 27KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 4KB - Virtual size: 3KB

bdata
Size: 4KB - Virtual size: 4B

idata
Size: 4KB - Virtual size: 4B

.rsrc
Size: 4KB - Virtual size: 2KB

.reloc
Size: 4KB - Virtual size: 1KB