04cbe14da27eb3108536d9a665633ab9

Sharing

Copy URL Twitter E-mail

General

Target

04cbe14da27eb3108536d9a665633ab9
Size

391KB
MD5

04cbe14da27eb3108536d9a665633ab9
SHA1

4209d3a9a1557e411ff426cc6b52b2ae855ffc47
SHA256

dd765fb2bd63f8eec600c28aedc189e380f8f43416b25b44a747cf65b2509161
SHA512

ba1376a4481abc7ff01405f521c741e2abd611a106c54c87c3767d613e9956fb7b463df645903cdcae1766113f9161d675a71e94ff0fe62e34d87c9ed2e4016f
SSDEEP

6144:ncncfK9DKjREIfUFwiMvEXSxadi6t7pzoHpzwKhlUF/DWww3jbITct8zSlHStCkL:fxjZli+ECc7XqjUFJwYTcYCHStCkm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
04cbe14da27eb3108536d9a665633ab9

Files

04cbe14da27eb3108536d9a665633ab9
.dll regsvr32 windows:4 windows x86 arch:x86

d2f75abe1a29a28648e86d4948da38f8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetProcAddress
GetModuleHandleA
LoadLibraryA
RaiseException
VirtualProtect
ExitProcess

user32

GetKeyboardType
CreateWindowExA

advapi32

RegQueryValueExA
RegSetValueExA

oleaut32

SysFreeString
VariantChangeTypeEx

wsock32

WSACleanup

urlmon

URLDownloadToFileW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

Size: - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Themid
Size: - Virtual size: 304KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Themid0
Size: - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE

.Themid1
Size: 389KB - Virtual size: 389KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d2f75abe1a29a28648e86d4948da38f8

Headers

File Characteristics

Imports

kernel32

user32

advapi32

oleaut32

wsock32

urlmon

Exports

Exports

Sections

Size: - Virtual size: 32KB

Size: - Virtual size: 4KB

Size: - Virtual size: 4KB

Size: - Virtual size: 4KB

Size: - Virtual size: 4KB

Size: - Virtual size: 4KB

.rsrc Size: 512B - Virtual size: 4KB

.Themid Size: - Virtual size: 304KB

.adata Size: - Virtual size: 4KB

.Themid0 Size: - Virtual size: 21KB

.Themid1 Size: 389KB - Virtual size: 389KB

.reloc Size: 512B - Virtual size: 112B

.rsrc
Size: 512B - Virtual size: 4KB

.Themid
Size: - Virtual size: 304KB

.adata
Size: - Virtual size: 4KB

.Themid0
Size: - Virtual size: 21KB

.Themid1
Size: 389KB - Virtual size: 389KB

.reloc
Size: 512B - Virtual size: 112B