0b382c486e666082025842df5a695b7f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0b382c486e666082025842df5a695b7f
Size

13KB
MD5

0b382c486e666082025842df5a695b7f
SHA1

8386247d859ff8542846576b6cfca78e90623f3f
SHA256

1b1b6295bf5aa96dda26bfa585463f5bbefbad446c87d25d7a8b2d88aee3ed5f
SHA512

54dcd80a1901ab11cc4e457465db9cbb57fda78c41c4187ff55ba61e575e754f26e2cbb0bbe29da32d43f1fe72ddbcf93037c2392f36444dc0f533c259048fb2
SSDEEP

384:tn/hiszANz3bIwCVEWbK2N6tG8/7H0RsXUl3dJO:tn/hiyABhCVE2GGMD0+XUlN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0b382c486e666082025842df5a695b7f

Files

0b382c486e666082025842df5a695b7f
.dll regsvr32 windows:4 windows x86 arch:x86

81e9462adf581916633196277d3ebdcf

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

winmm

timeGetTime

wininet

InternetConnectA
InternetCloseHandle
FtpGetFileA
InternetOpenA
InternetGetConnectedState

mfc42

ord5442
ord5186
ord1979
ord6010
ord6385
ord354
ord665

msvcrt

_initterm
free
_onexit
time
srand
rand
sprintf
strcmp
strlen
strcat
__CxxFrameHandler
memset
strcpy
malloc
__dllonexit
_adjust_fdiv

kernel32

GetProcAddress
LoadLibraryA
FreeLibrary
Sleep
GetWindowsDirectoryA
DeleteFileA
GetCommandLineA

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey

shell32

ShellExecuteA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Dll_JustWorking

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 656B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ