0d034ccb82e83ed4c923d8d5f15254aa | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0d034ccb82e83ed4c923d8d5f15254aa
Size

255KB
MD5

0d034ccb82e83ed4c923d8d5f15254aa
SHA1

8e4d44facc8e6d863a25b613da11dc53d1b8b303
SHA256

01fb4bfd292ffeb8b5a3c24a176abf05f42150004a13be0cd4a9c18fd2793933
SHA512

e9c1b507f46db94ac07c581f12bdbcc224c60afec746b4e037868169de5954af363a434e7ed104c7b7bf843f49b5618187fd5928a1730d6207801f8743fec2e4
SSDEEP

6144:OLgfb8HCVgyFyTiLG7uTfZE6qfGDdrtyi2YcWLIlNx:zfba/MC7uzlqfidIKcWSNx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0d034ccb82e83ed4c923d8d5f15254aa

Files

0d034ccb82e83ed4c923d8d5f15254aa
.dll regsvr32 windows:4 windows x86 arch:x86

bd227ba966c127e93fe82f25f211eaca

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

VirtualFree
VirtualAlloc
GetProcAddress
ExitProcess
LoadLibraryExA
GetModuleHandleA
VirtualProtect
GetModuleFileNameA
HeapAlloc
GetProcessHeap
HeapFree

user32

wsprintfA
MessageBoxA

Exports

Exports

DllRegisterServer
DllUnregisterServer

Sections

.data
Size: 221KB - Virtual size: 612KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_cod
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_rl
Size: 288B - Virtual size: 280B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ