20817ecf3a7c3e6dafff832750e1d648

Sharing

Copy URL Twitter E-mail

General

Target

20817ecf3a7c3e6dafff832750e1d648
Size

21KB
MD5

20817ecf3a7c3e6dafff832750e1d648
SHA1

773dab22adcff56a51c39721395f574320065cdf
SHA256

87aa1cfb577045a0b310e55060d9718900b4e9970ecb000e8f7f37c18a7d5a7e
SHA512

1422f7a4ce83553a0859fefa3cc86bb3409f0da6e3460416e0bf0637bc246d7674f2b5a74832ced88d29266da4078edc45540dd21cb8c2de3ea000fe1ee832b2
SSDEEP

384:r0boN/yeVPoRXI4KXq8EIB7BN39kWOwudN582OXylia:r0+aeVQdI4x8T1BrkWhun58lil

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
20817ecf3a7c3e6dafff832750e1d648

Files

20817ecf3a7c3e6dafff832750e1d648
.dll regsvr32 windows:4 windows x86 arch:x86

f6f5f9f9bbae4b993bfbe8dcf83635eb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateMutexA
DeleteFileA
DebugBreak
HeapReAlloc
HeapFree
GetLastError
GetSystemTimeAsFileTime
ReleaseMutex
CloseHandle
MultiByteToWideChar
Sleep
lstrlenA
WideCharToMultiByte
lstrlenW
CreateEventA
LocalFree
HeapAlloc
GetSystemInfo
HeapCreate
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
DisableThreadLibraryCalls
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement

advapi32

RegCloseKey
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
RegOpenKeyExA
RegDeleteValueA
RegDeleteKeyA

ole32

CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

VariantClear
SysFreeString
LoadRegTypeLi
SysStringLen
VariantInit
SysAllocString
VariantCopy
VariantChangeType

wininet

InternetCloseHandle
InternetReadFile
HttpSendRequestA
InternetOpenA
InternetConnectA
HttpOpenRequestA

atl

ord21
ord16
ord15
ord18
ord57
ord32
ord58
ord30
ord23

msvcrt

strcpy
memset
time
srand
strstr
rand
sprintf
memcmp
memcpy
strlen
strncmp
_stricmp
wcslen
_CxxThrowException
__dllonexit
_onexit
??1type_info@@UAE@XZ
strncpy

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
calloc
free
malloc
realloc

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f6f5f9f9bbae4b993bfbe8dcf83635eb

Headers

File Characteristics

Imports

kernel32

advapi32

ole32

oleaut32

wininet

atl

msvcrt

Exports

Exports

Sections

.text Size: 11KB - Virtual size: 10KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 1024B - Virtual size: 976B

.CRT Size: 512B - Virtual size: 4B

.rsrc Size: 3KB - Virtual size: 3KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 11KB - Virtual size: 10KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 1024B - Virtual size: 976B

.CRT
Size: 512B - Virtual size: 4B

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 1KB - Virtual size: 1KB