3970fd2a4641c79166115403bb65b83f

Sharing

Copy URL Twitter E-mail

General

Target

3970fd2a4641c79166115403bb65b83f
Size

84KB
MD5

3970fd2a4641c79166115403bb65b83f
SHA1

dc10f252316051792cb14346ef0f3b6348224c67
SHA256

2efa08e03b5e8a8f5f23225e3405ab79c48ff3a6b7c0275f79e306739dd12793
SHA512

c19a8684cf01d62ea579e296f634095731d727c3b79d4e923eb024f20559979cd8777e840a966963d254066eed69626c36d13edee1486e66e5b9b9178d11ca53
SSDEEP

1536:ImAfbghYotaV8sO9XTNfVFs9MEJoENZec4m:9AwYBesQGWEJoENH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3970fd2a4641c79166115403bb65b83f

Files

3970fd2a4641c79166115403bb65b83f
.dll regsvr32 windows:4 windows x86 arch:x86

dcddd7ab5fe3c3c4474da01377a0429c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MultiByteToWideChar
GetSystemTime
CloseHandle
WideCharToMultiByte
FlushFileBuffers
SetStdHandle
lstrcpyA
lstrlenW
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetModuleFileNameA
DisableThreadLibraryCalls
HeapFree
HeapAlloc
GetCommandLineA
GetVersion
GetCPInfo
GetACP
GetOEMCP
ExitProcess
LCMapStringA
LCMapStringW
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
RtlUnwind
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
GetStringTypeA
GetStringTypeW
SetFilePointer
GetProcAddress
LoadLibraryA

user32

GetWindowTextA
SetWindowTextA
FindWindowExA

oleaut32

VariantCopy
VariantChangeType
VariantClear
SysAllocStringLen
SysStringLen
LoadRegTypeLi
SysFreeString

atl

ord58
ord30
ord32
ord15
ord23
ord57
ord18
ord21
ord16
ord31

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 40KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dcddd7ab5fe3c3c4474da01377a0429c

Headers

File Characteristics

Imports

kernel32

user32

oleaut32

atl

Exports

Exports

Sections

.text Size: 40KB - Virtual size: 36KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 28KB - Virtual size: 34KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 40KB - Virtual size: 36KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 28KB - Virtual size: 34KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 4KB - Virtual size: 3KB