52a68c39a25c1f658fdcd5f4ba151f98 | Triage

Sharing

General

Target

52a68c39a25c1f658fdcd5f4ba151f98
Size

302KB
MD5

52a68c39a25c1f658fdcd5f4ba151f98
SHA1

06c7e71324c4cedffdb31cbe083063104b3b4d88
SHA256

5d89c80df6da1b803dc789e104fd03c022e133c9f8c9ae251a1315309b3a8ffa
SHA512

1c52b3a7a3cb48cc93bca7d84bd8e5171d631a68459f5f99e89e26814d4ec7b5278b21ee11bc8bbcfcb51d1e465d766e8d8873d2c3419f698237601aae7043e4
SSDEEP

6144:Fn2+l1nFgtYyKnXYTOl7Vru9vMt7b+Aw/HrfSMg6Jg:0dKoTm7x4vw7RULf3g6W

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

52a68c39a25c1f658fdcd5f4ba151f98

Files

52a68c39a25c1f658fdcd5f4ba151f98
.dll regsvr32 windows:6 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

DllRegisterServer
DllUnregisterServer
HymjcleecoquBjawwinzcq
ResumeServer
StartServer
StartW
StopServer
SuspendServer
VltnpirsaAfdpgesMvlyolkpzk

Sections

.text
Size: 166KB - Virtual size: 165KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 134KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 240B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ