7ad28d3bd134737b48da6a39dab4a623

Sharing

Copy URL Twitter E-mail

General

Target

7ad28d3bd134737b48da6a39dab4a623
Size

90KB
MD5

7ad28d3bd134737b48da6a39dab4a623
SHA1

858056216aa82bd17de550ac2865bae15068ad49
SHA256

41514c19553290815fd5f07dbea35c5ed96e610c4b2959cc09903a63879eae75
SHA512

5c6d280eaa345a41d7ebee29a2c29d26129757b739620acdbc9e31f2802e972e44913e3575c0e57d298f52d9ee49ac196c90708892c15cb51e9d65762cc2ca26
SSDEEP

1536:eAz3FW+n8z18mb58oQsBhtRkGYrL/kZWjHK3UGWdzgU6urnj1IL0ldcqJKGOKQLR:eAz3FWvXOoQsBhtRkmZWGZWOU6urnj13

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7ad28d3bd134737b48da6a39dab4a623

Files

7ad28d3bd134737b48da6a39dab4a623
.dll windows:5 windows x86 arch:x86

d1479fc44b69db2aedb2e3087a983050

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

O:\OOO330\ooo\registry\wntmsci12.pro\bin\reg3.pdb

Imports

sal3

rtl_ustr_compare_WithLength
rtl_str_getLength
rtl_uString_new
rtl_string_new
rtl_string_acquire
rtl_uString2String
rtl_string_release
rtl_string_assign
rtl_uString_release
rtl_ustr_getLength
rtl_copyMemory
rtl_uString_getLength
rtl_uString_acquire
rtl_uString_assign
rtl_uString_newFromString
rtl_allocateZeroMemory
rtl_uStringbuffer_newFromStr_WithLength
rtl_ustr_reverseCompare_WithLength
osl_getThreadTextEncoding
rtl_allocateMemory
osl_getSystemPathFromFileURL
rtl_uStringbuffer_insert
rtl_uString_new_WithLength
osl_releaseMutex
osl_acquireMutex
osl_destroyMutex
osl_createMutex
rtl_uString_getToken
rtl_uString_newFromStr_WithLength
rtl_ustr_lastIndexOfChar_WithLength
rtl_ustr_hashCode_WithLength
rtl_string2UString
rtl_uString_newConcat
rtl_uString_newFromStr
rtl_string_newConcat
rtl_string_newFromStr
rtl_freeMemory

store3

store_flushFile
store_closeFile
store_createMemoryFile
store_openFile
store_findNext
store_findFirst
store_openDirectory
store_acquireHandle
store_writeStream
store_readStream
store_openStream
store_releaseHandle
store_remove

msvcr90

??2@YAPAXI@Z
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
?terminate@@YAXXZ
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_encode_pointer
fprintf
__iob_func
printf
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBDH@Z
??1exception@std@@UAE@XZ
_unlink
??3@YAXPAX@Z
__CxxFrameHandler3
??_V@YAXPAX@Z
memcpy
??_U@YAPAXI@Z

kernel32

GetCurrentProcessId
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
InterlockedExchange
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
InterlockedCompareExchange
Sleep

stlport_vc7145

?deallocate@?$__node_alloc@$00$0A@@_STL@@SAXPAXI@Z
??0?$vector@PAXV?$allocator@PAX@_STL@@@_STL@@QAE@ABV?$allocator@PAX@1@@Z
?get_allocator@?$vector@PAXV?$allocator@PAX@_STL@@@_STL@@QBE?AV?$allocator@PAX@2@XZ
??0?$vector@PAXV?$allocator@PAX@_STL@@@_STL@@QAE@IABQAXABV?$allocator@PAX@1@@Z
?swap@?$vector@PAXV?$allocator@PAX@_STL@@@_STL@@QAEXAAV12@@Z
??1?$allocator@PAX@_STL@@QAE@XZ
?reserve@?$vector@PAXV?$allocator@PAX@_STL@@@_STL@@QAEXI@Z
?_M_fill_insert@?$vector@PAXV?$allocator@PAX@_STL@@@_STL@@QAEXPAPAXIABQAX@Z
??1?$vector@PAXV?$allocator@PAX@_STL@@@_STL@@QAE@XZ
?_Rebalance@?$_Rb_global@_N@_STL@@SAXPAU_Rb_tree_node_base@2@AAPAU32@@Z
?_M_decrement@?$_Rb_global@_N@_STL@@SAPAU_Rb_tree_node_base@2@PAU32@@Z
?allocate@?$__node_alloc@$00$0A@@_STL@@SAPAXI@Z

Exports

Exports

GetVersionInfo
initRegistryTypeReader_Api
initRegistryTypeWriter_Api
initRegistry_Api
reg_closeKey
reg_closeRegistry
reg_closeSubKeys
reg_createKey
reg_createLink
reg_createRegistry
reg_deleteKey
reg_deleteLink
reg_destroyRegistry
reg_dumpRegistry
reg_freeValueList
reg_getKeyName
reg_getKeyType
reg_getLinkTarget
reg_getLongListValue
reg_getName
reg_getResolvedKeyName
reg_getStringListValue
reg_getUnicodeListValue
reg_getValue
reg_getValueInfo
reg_isReadOnly
reg_loadKey
reg_mergeKey
reg_openKey
reg_openRegistry
reg_openRootKey
reg_openSubKeys
reg_saveKey
reg_setLongListValue
reg_setStringListValue
reg_setUnicodeListValue
reg_setValue
typereg_reader_acquire
typereg_reader_create
typereg_reader_getDocumentation
typereg_reader_getFieldCount
typereg_reader_getFieldDocumentation
typereg_reader_getFieldFileName
typereg_reader_getFieldFlags
typereg_reader_getFieldName
typereg_reader_getFieldTypeName
typereg_reader_getFieldValue
typereg_reader_getFileName
typereg_reader_getMethodCount
typereg_reader_getMethodDocumentation
typereg_reader_getMethodExceptionCount
typereg_reader_getMethodExceptionTypeName
typereg_reader_getMethodFlags
typereg_reader_getMethodName
typereg_reader_getMethodParameterCount
typereg_reader_getMethodParameterFlags
typereg_reader_getMethodParameterName
typereg_reader_getMethodParameterTypeName
typereg_reader_getMethodReturnTypeName
typereg_reader_getReferenceCount
typereg_reader_getReferenceDocumentation
typereg_reader_getReferenceFlags
typereg_reader_getReferenceSort
typereg_reader_getReferenceTypeName
typereg_reader_getSuperTypeCount
typereg_reader_getSuperTypeName
typereg_reader_getTypeClass
typereg_reader_getTypeName
typereg_reader_getVersion
typereg_reader_isPublished
typereg_reader_release
typereg_writer_create
typereg_writer_destroy
typereg_writer_getBlob
typereg_writer_setFieldData
typereg_writer_setMethodData
typereg_writer_setMethodExceptionTypeName
typereg_writer_setMethodParameterData
typereg_writer_setReferenceData
typereg_writer_setSuperTypeName

Sections

.text
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d1479fc44b69db2aedb2e3087a983050

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

sal3

store3

msvcr90

kernel32

stlport_vc7145

Exports

Exports

Sections

.text Size: 63KB - Virtual size: 62KB

.rdata Size: 20KB - Virtual size: 20KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 63KB - Virtual size: 62KB

.rdata
Size: 20KB - Virtual size: 20KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 3KB