0b0fdf3b4bb1b59fa3587bb50ed0da69 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0b0fdf3b4bb1b59fa3587bb50ed0da69
Size

175KB
MD5

0b0fdf3b4bb1b59fa3587bb50ed0da69
SHA1

d7c74cf7b9ec3e9d30361e020e7d24782b916423
SHA256

560dcccd0ea182a5fc840a4bc88efb592256b63b7f1e13ae64c76b3f16f79168
SHA512

08ee5a3b691ba4b1922f97af38d4833d9a253c10d6bf1d5bd5b1b2472a913db1fbe1514f15d13db47e5d2697c08545cb268bd3456a75bd7b60f243d6edb31ead
SSDEEP

3072:1gItroEgTfdEFUGOGNlaUkRawfMv2tGiq4YumLRDn4tEWn2sctQUFT6tfDQZdo2H:aP1aUI+qN7T5vgffkTs5u

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0b0fdf3b4bb1b59fa3587bb50ed0da69

Files

0b0fdf3b4bb1b59fa3587bb50ed0da69
.dll regsvr32 windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
JumpHookOff
JumpHookOn

Sections

CODE
Size: 148KB - Virtual size: 147KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 5KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 204B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.MaskPE
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ