28609e1ac70c295552cc83c890e82e6e

Sharing

Copy URL

Twitter E-mail

General

Target

28609e1ac70c295552cc83c890e82e6e
Size

88KB
MD5

28609e1ac70c295552cc83c890e82e6e
SHA1

077cacf38c094a76efe9400cde4345b0a20a1269
SHA256

15ed99495a67533ca08b4889c1122fb438fe27593ae60c7d7e123bbcac5f2748
SHA512

d81bc3ce08df8eeb89284f0f2e39f01e3d03e0fb11e1563e788f22ece1ebe31180d6de905cf5fc5dc27604b4e12f03ac71a62438d491d0630e986c5775a9fad7
SSDEEP

1536:ordJRRNC7Zxt3b+QB+xe8HqtIWJC/jv79aIqiHgELIAY87:m07ZxEtMvtIa+jEID1LIAY87

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
28609e1ac70c295552cc83c890e82e6e

Files

28609e1ac70c295552cc83c890e82e6e
.dll regsvr32 windows:4 windows x86 arch:x86

e8d2f6a4db2a794274a74f81b3998216

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FreeLibrary
GetModuleFileNameA
LoadLibraryA
GetLastError
FindResourceA
LoadResource
GetFileSize
CreateFileA
CloseHandle
ReadFile
SetFilePointer
GetVersion
GetFullPathNameA
GetProcAddress
LockResource

user32

IsDlgButtonChecked
CheckRadioButton
SendDlgItemMessageA
LoadStringA
OemToCharBuffA
SetWindowLongA
CheckDlgButton
GetWindowLongA

advapi32

RegCloseKey
RegSetValueExA

msvcrt

atoi
_strcmpi
_adjust_fdiv
??1type_info@@UAE@XZ
strlen
_purecall
memset
strcpy
memcpy
malloc
_initterm
??3@YAXPAX@Z
??2@YAPAXI@Z
__CxxFrameHandler
_CxxThrowException
free

Exports

Exports

ChainFltGetPages_TableText
ChainFltInit_TableText
DllRegisterServer
DllUnregisterServer
FolioTools_RegisterA
FromFltGetPages_
FromFltGetPages_TableText
FromFltInit_
FromFltInit_TableText
FromFltIsMyFile_
FromFltIsMyFile_TableText
ToFltGetPages_
ToFltInit_
_BeginOutStream@8
_EndOutStream@4
_FrTableFltCallBack@16
_FrTableFltCleanup@4
_FrTableParseStream@16
_MyFltCleanup@4
_MyFltParseStream@16
_MyFromFilterCallBack@16
_MyWriteCode@16
_TableTextCleanup@4
_TableTextWriteCode@16
_ToExpcCleanup@4

Sections

.text
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 974B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e8d2f6a4db2a794274a74f81b3998216

Headers

File Characteristics

Imports

kernel32

user32

advapi32

msvcrt

Exports

Exports

Sections

.text Size: 12KB - Virtual size: 10KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 60KB - Virtual size: 59KB

.rsrc Size: 4KB - Virtual size: 960B

.reloc Size: 4KB - Virtual size: 974B

.text
Size: 12KB - Virtual size: 10KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 60KB - Virtual size: 59KB

.rsrc
Size: 4KB - Virtual size: 960B

.reloc
Size: 4KB - Virtual size: 974B