4d2733f8a7c54c5b6e700e5b16643692

Sharing

Copy URL Twitter E-mail

General

Target

4d2733f8a7c54c5b6e700e5b16643692
Size

64KB
MD5

4d2733f8a7c54c5b6e700e5b16643692
SHA1

47cfedc6db6471f9f7fcff081b53d66f26df68c5
SHA256

db8f73f96c988e4c5759e4a2b7eb4908ef5b7ab45e05d2b048383e545b93f7cf
SHA512

0e987d3923fd3ae64fbb81295d77a45e956841cf85158b2c25b205e07e01a6355cb8aac815e8443a738c3c120c8d34963989e53bc93b4ec57e22d1483f6f8851
SSDEEP

1536:aN1+fnKdcy+PmsUonjtLUrCfaFisJIQ0BM:01pP+7U0RAyBM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4d2733f8a7c54c5b6e700e5b16643692

Files

4d2733f8a7c54c5b6e700e5b16643692
.dll regsvr32 windows:4 windows x86 arch:x86

babc08c0e8c4c54255706f9a61b13b89

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
Sleep
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetSystemDirectoryA
WritePrivateProfileStringA
LocalFree
ExitProcess
WideCharToMultiByte
RemoveDirectoryA
DeleteFileA
GetProcAddress
FreeLibrary
FindNextFileA
SetFileAttributesA
GetPrivateProfileStringA
FindFirstFileA
GetCommandLineW
CreateDirectoryA
MoveFileA
CreateThread
GetModuleHandleA
GetShortPathNameA
lstrlenA
MultiByteToWideChar
lstrlenW
HeapDestroy
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
GetModuleFileNameA
Process32First
CloseHandle
Process32Next
GetCurrentProcessId

advapi32

RegQueryInfoKeyA
RegSetValueExA
RegEnumKeyExA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegDeleteKeyA
RegCreateKeyExA

shell32

SHGetSpecialFolderPathA
CommandLineToArgvW

ole32

CoUninitialize
CoInitialize
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoCreateInstance

oleaut32

SysAllocString
VariantClear
SysStringLen
LoadRegTypeLi
SysFreeString

msvcrt

strchr
_strupr
_stricmp
_adjust_fdiv
malloc
_initterm
free
_wcslwr
wcsstr
atoi
strstr
fopen
fseek
ftell
fread
fclose
strcpy
strcmp
strrchr
memcpy
_purecall
??3@YAXPAX@Z
??2@YAPAXI@Z
memcmp
sprintf
strncpy
_strlwr
memset
strncmp
strlen
strcat
_access

shlwapi

SHSetValueA
SHDeleteValueA
SHDeleteKeyA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

mdata
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

bdata
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

idata
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

babc08c0e8c4c54255706f9a61b13b89

Headers

File Characteristics

Imports

kernel32

advapi32

shell32

ole32

oleaut32

msvcrt

shlwapi

Exports

Exports

Sections

.text Size: 32KB - Virtual size: 28KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 4KB - Virtual size: 4KB

mdata Size: 4KB - Virtual size: 4B

bdata Size: 4KB - Virtual size: 4B

idata Size: 4KB - Virtual size: 4B

.rsrc Size: 4KB - Virtual size: 2KB

.reloc Size: 4KB - Virtual size: 2KB

.text
Size: 32KB - Virtual size: 28KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 4KB - Virtual size: 4KB

mdata
Size: 4KB - Virtual size: 4B

bdata
Size: 4KB - Virtual size: 4B

idata
Size: 4KB - Virtual size: 4B

.rsrc
Size: 4KB - Virtual size: 2KB

.reloc
Size: 4KB - Virtual size: 2KB