0a9961a77874d4ea6f7dfd70e3096d8d

Sharing

Copy URL Twitter E-mail

General

Target

0a9961a77874d4ea6f7dfd70e3096d8d
Size

52KB
MD5

0a9961a77874d4ea6f7dfd70e3096d8d
SHA1

ce5809e3427de86864118b4b1afc1ef99ec5500b
SHA256

57392ae54de37ebe3f1d8ef069a9b8e155790328d141dc4fa51fe753c79f0e2b
SHA512

2c5ac4bc241e367b27195d3ead673cf65688d47107d4c9a6505681d749173d98d67092392b4c023a75c2a9bb5724911633b5aee5620866aba171e72975fbb0b8
SSDEEP

1536:mSzNs6Ajj3PoPfdRR9sd94jLfQfOfCFvkm:B4o3dByg2km

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0a9961a77874d4ea6f7dfd70e3096d8d

Files

0a9961a77874d4ea6f7dfd70e3096d8d
.dll regsvr32 windows:4 windows x86 arch:x86

0f1b0566078cfe953e2348ba223533aa

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetExitCodeProcess
WaitForSingleObject
GetSystemDirectoryA
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
HeapDestroy
lstrlenW
lstrlenA
RemoveDirectoryA
GetModuleHandleA
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
WideCharToMultiByte
GetCurrentProcessId
CreateThread
WritePrivateProfileStringA
GetCommandLineW
ExitProcess
CreateProcessA
Sleep
LocalFree
GetModuleFileNameA
Process32First
Process32Next
CloseHandle
CreateDirectoryA
GetProcAddress
MultiByteToWideChar
SetFileAttributesA
DeleteFileA
MoveFileA
FreeLibrary
LoadLibraryA
GetShortPathNameA

advapi32

GetNamedSecurityInfoA
SetEntriesInAclA
SetNamedSecurityInfoA
RegCreateKeyExA
RegSetValueExA
RegQueryInfoKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegDeleteKeyA
BuildExplicitAccessWithNameA

shell32

SHGetSpecialFolderPathA
CommandLineToArgvW

ole32

CoInitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoUninitialize
CoCreateInstance

oleaut32

VariantClear
SysAllocString
SysStringLen
LoadRegTypeLi
SysFreeString

msvcrt

strncpy
_strlwr
_stricmp
_adjust_fdiv
malloc
_initterm
free
fopen
fseek
ftell
fread
fclose
strcmp
_wcslwr
wcsstr
strrchr
sprintf
strlen
??3@YAXPAX@Z
strstr
_access
strcat
strcpy
memset
atoi
strchr
_strupr
strncmp
memcpy
_purecall
??2@YAPAXI@Z
memcmp

shlwapi

SHDeleteValueA
SHSetValueA
SHDeleteKeyA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

idata
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0f1b0566078cfe953e2348ba223533aa

Headers

File Characteristics

Imports

kernel32

advapi32

shell32

ole32

oleaut32

msvcrt

shlwapi

Exports

Exports

Sections

.text Size: 32KB - Virtual size: 28KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 4KB - Virtual size: 4KB

idata Size: 4KB - Virtual size: 4B

.reloc Size: 4KB - Virtual size: 2KB

.text
Size: 32KB - Virtual size: 28KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 4KB - Virtual size: 4KB

idata
Size: 4KB - Virtual size: 4B

.reloc
Size: 4KB - Virtual size: 2KB