ff27b9e8314d4a018d1497f027e29d2e

Sharing

Copy URL Twitter E-mail

General

Target

ff27b9e8314d4a018d1497f027e29d2e
Size

644KB
MD5

ff27b9e8314d4a018d1497f027e29d2e
SHA1

e512c9bd6b75fe3d9825fdf3f730f37a4d9d24d6
SHA256

ac3d38408bfd78d68432494d4e8a3bf3bdb869c2f69acec53846b2e1c1728d92
SHA512

134676690e2367bf0c1f5879b3c3086855cd771d1499983dcb74b750121ddd40b1a839c24f9709ba4a05a1849b4684be9d33ce295b359bbfcd434f5fe0a2c7a1
SSDEEP

12288:ALdGsApP0GxdIuiYnS11Ku6iWDEXDm4b1nz:AFApPNxniYn0kiWwXa45z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ff27b9e8314d4a018d1497f027e29d2e

Files

ff27b9e8314d4a018d1497f027e29d2e
.dll regsvr32 windows:5 windows x64 arch:x64

dd8db7231a7a01663374a7ed6baa9ef4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

advapi32

RegOpenUserClassesRoot
GetOldestEventLogRecord

ole32

GetHGlobalFromILockBytes
HWND_UserSize

user32

GetMenuState
EndDeferWindowPos
KillTimer

kernel32

GetSystemPowerStatus
GetBinaryTypeW
GetModuleHandleW
GetModuleFileNameW
ExitProcess
GetCurrentThreadId

winmm

waveInAddBuffer

Exports

Exports

?AfxFreeLibrary@@YAHPEAUHINSTANCE__@@@Z
?AfxLoadLibrary@@YAPEAUHINSTANCE__@@PEBG@Z
?AfxLockGlobals@@YAXH@Z
?AfxUnlockGlobals@@YAXH@Z
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.code
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 356KB - Virtual size: 352KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 800B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.code
Size: 216KB - Virtual size: 215KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 296B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.nbl
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dd8db7231a7a01663374a7ed6baa9ef4

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

ole32

user32

kernel32

winmm

Exports

Exports

Sections

.text Size: 4KB - Virtual size: 3KB

.code Size: 12KB - Virtual size: 8KB

.rdata Size: 356KB - Virtual size: 352KB

.data Size: 12KB - Virtual size: 11KB

.pdata Size: 4KB - Virtual size: 800B

.code Size: 216KB - Virtual size: 215KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 296B

.nbl Size: 28KB - Virtual size: 27KB

.text
Size: 4KB - Virtual size: 3KB

.code
Size: 12KB - Virtual size: 8KB

.rdata
Size: 356KB - Virtual size: 352KB

.data
Size: 12KB - Virtual size: 11KB

.pdata
Size: 4KB - Virtual size: 800B

.code
Size: 216KB - Virtual size: 215KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 296B

.nbl
Size: 28KB - Virtual size: 27KB