27653dcb7a6aa6f13323942b9ef4cf37

Sharing

Copy URL

Twitter E-mail

General

Target

27653dcb7a6aa6f13323942b9ef4cf37
Size

48KB
MD5

27653dcb7a6aa6f13323942b9ef4cf37
SHA1

88045fefcd6039fe748d7a0858efa47f4fdeec1d
SHA256

a1e14ac5e7026226250c8329dcb73709222c27111ec16e1d8878421f1aac8fa2
SHA512

3c504f779a44692eaeba2abc3b9e8c811e27cad2194c2555db90485eaa4b4cba9dde0e41c6f691069065be70d5492b4ee375f5d3726a1bad0b9b12ccefc4bb22
SSDEEP

768:Ez7wJZXyafl90A4o1WNBhKf2+pt3/D+B:1B3sGWNBR+pB/yB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
27653dcb7a6aa6f13323942b9ef4cf37

Files

27653dcb7a6aa6f13323942b9ef4cf37
.dll regsvr32 windows:4 windows x86 arch:x86

15b56f39bb1217c6a490ff6a21356d7a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ReadFile
CreateFileA
GetWindowsDirectoryA
GetSystemDirectoryA
GetProcAddress
LoadLibraryA
WriteFile
GetTempPathA
IsBadStringPtrA
WritePrivateProfileStringA
LeaveCriticalSection
GetPrivateProfileIntA
GetPrivateProfileStringA
DeleteFileA
EnterCriticalSection
WriteProcessMemory
VirtualAlloc
GetModuleHandleA
Process32Next
OpenProcess
lstrcmpiA
Process32First
CreateToolhelp32Snapshot
MoveFileExA
CopyFileA
GetSystemDirectoryW
MultiByteToWideChar
ExitThread
GetLastError
GetCurrentProcess
TerminateProcess
Sleep
GetModuleFileNameA
InitializeCriticalSection
CreateThread
GetCommandLineA
CloseHandle

user32

EnumWindows
GetSystemMetrics
wsprintfA
GetWindowRect
GetWindowDC
SetWindowPos
ShowWindow
GetWindowTextA
IsWindowVisible
GetDesktopWindow

gdi32

CreateCompatibleDC
SelectObject
BitBlt
GetDeviceCaps
CreateCompatibleBitmap
DeleteObject

advapi32

RegEnumValueA
RegCloseKey
RegOpenKeyA

wininet

HttpSendRequestA
InternetSetOptionA
InternetOpenUrlA
InternetReadFile
InternetCloseHandle
InternetQueryOptionA
HttpOpenRequestA
InternetConnectA
InternetOpenA

ws2_32

send
closesocket
htons
inet_addr
inet_ntoa
WSAStartup
socket
WSACleanup
connect
gethostbyname

gdiplus

GdiplusStartup
GdipCreateBitmapFromScan0
GdipCreateBitmapFromHBITMAP
GdipGetImageGraphicsContext
GdipScaleWorldTransform
GdipDrawImageI
GdipSaveImageToFile
GdipDeleteGraphics
GdipDisposeImage
GdipGetImageEncodersSize
GdipGetImageEncoders

shlwapi

PathFileExistsA

msvcrt

_CxxThrowException
??1exception@@UAE@XZ
??0exception@@QAE@ABQBD@Z
__dllonexit
_onexit
_initterm
_adjust_fdiv
??1type_info@@UAE@XZ
strlen
_strlwr
??0exception@@QAE@ABV0@@Z
wcscpy
wcscat
sprintf
memmove
__CxxFrameHandler
strchr
atoi
malloc
wcscmp
free
_except_handler3
??2@YAPAXI@Z
strstr

Exports

Exports

CreateComponent
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetComponentIDs
MsimtfIsGuidMapEnable
MsimtfIsWindowFiltered
Run
SetDLLRegistry
SetFactoryHandle
TenioDllCanUnloadNow
TenioDllFreeMap
TenioSetDllSafe

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

15b56f39bb1217c6a490ff6a21356d7a

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

wininet

ws2_32

gdiplus

shlwapi

msvcrt

Exports

Exports

Sections

.text Size: 28KB - Virtual size: 27KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 4KB - Virtual size: 4KB

.reloc Size: 4KB - Virtual size: 2KB

.text
Size: 28KB - Virtual size: 27KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 4KB - Virtual size: 4KB

.reloc
Size: 4KB - Virtual size: 2KB