0cc99a641ba40204b63b63cd03efc5df | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0cc99a641ba40204b63b63cd03efc5df
Size

188KB
MD5

0cc99a641ba40204b63b63cd03efc5df
SHA1

1f915582dd8f93b95e6fbf3748a9f4495be7345e
SHA256

d34dd26ccc1bfecc424566f0262e855d61581078dc342aa84038c02e8f2bd751
SHA512

a91bc97f3ff44358ebc273ede919405db85be167685fb5570ad225f691456806a4f5e37d2e39f57c69f5f1e630cf28e3bffb8fc0e3ca43d6c1d8f6fcbd100c8e
SSDEEP

3072:YWa3N1eqJ7cNe58per6JpynepWHVD9qMe402JYIUk9H8Iz83SWZ9klSC:IxwO/Spynep6VDcMeQeIUk9cI6h5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0cc99a641ba40204b63b63cd03efc5df

Files

0cc99a641ba40204b63b63cd03efc5df
.dll windows:5 windows x86 arch:x86

86bd8478222b7f02b724c9321381bb0a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

oleaut32

VarR8FromCy
VarDecFromR8

kernel32

LoadLibraryExA
GetModuleHandleW
GetModuleFileNameA
Sleep
FindActCtxSectionGuid
GetGeoInfoW

mprapi

MprAdminMIBEntryGetNext

advapi32

RegisterServiceCtrlHandlerA
RegLoadAppKeyA

user32

UnionRect
ShowOwnedPopups

ntdsapi

DsBindWithCredW

msvcrt

memset
strlen

crypt32

CryptFreeOIDFunctionAddress

setupapi

SetupCloseInfFile

winmm

waveOutGetPitch

gdi32

CreateColorSpaceA

Exports

Exports

WeprmcFosller

Sections

.text
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 124KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ