63acd6505a5c7fca9f3a648c4d8d2c7e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

63acd6505a5c7fca9f3a648c4d8d2c7e
Size

509KB
MD5

63acd6505a5c7fca9f3a648c4d8d2c7e
SHA1

408473a2f1fc0fb1bda675f5432c70accb7de9cb
SHA256

ac9c54eadfa423067e09fb960392c5c9226e1e4e473761e798d49e351119ed83
SHA512

ccb7b499a26c2024b1020d9b276cbb1eb8cb3af9138b3ef8b9a2bb87ea9a87ce0d65b8905be3d7ec954dd431b3c1de9072be3fe835a7b01775474ffde6234e95
SSDEEP

12288:K0kBuHsZfYLyB9SqoKumDXh1al+hte5+tAL7LwOJ50UWpGtJxK:7HnqoKpXLaUygKPwob

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
63acd6505a5c7fca9f3a648c4d8d2c7e

Files

63acd6505a5c7fca9f3a648c4d8d2c7e
.dll regsvr32 windows:5 windows x86 arch:x86

0021f47781268b6caaf314d0b686997c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL

Imports

kernel32

ExitProcess
FreeLibrary
GetModuleHandleW
GetVersionExW
lstrcmpiA
GetProcAddress
DeleteFileA
VirtualProtect
GetCurrentProcess
GetCurrentThreadId
GetTickCount
lstrcpyW
lstrlenW

user32

wsprintfW

Exports

Exports

CPlApplet
DllCanUnloadNow
DllGetClassObject
DllGetClassObjectEx
DllRegisterServer
DllRegisterServerEx
DllUnregisterServer
DllUnregisterServerEx

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 326B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.stub
Size: 500KB - Virtual size: 500KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE