7ec459f1295dd0c0fba4279c4a4a3336 | Triage

Sharing

General

Target

7ec459f1295dd0c0fba4279c4a4a3336
Size

288KB
MD5

7ec459f1295dd0c0fba4279c4a4a3336
SHA1

0814acaad186333e3ce126b691d06b57eff62b2d
SHA256

acba294d268c0eb1d5275c596f0def1aac68a712afcbe74a7f5cb5a17705befd
SHA512

61ecd0fa5900865113516f892a87ab3c7c0c69978201f000687fb8781bd1296a4cb6f0a03434c8fdb6797dd689b9049733af009a30b023f1b15f7c8fe7c5b0bb
SSDEEP

3072:p6QlU5T0+vk+wYDgN3XwmbvV4Ynnbe9rhNifQMpnIjZ9jAPUn4CbwKL0Fo3dgqTU:pXEwZSZeKZVA6BNL0F1h31eMgIf1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

7ec459f1295dd0c0fba4279c4a4a3336

Files

7ec459f1295dd0c0fba4279c4a4a3336
.dll regsvr32 windows:6 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

DllRegisterServer
DllUnregisterServer
NevtAmdfxsoZubqmdnz
QotlcerqxcgFjxvwybou
ResumeServer
StartServer
StartW
StopServer
SuspendServer

Sections

.text
Size: 140KB - Virtual size: 140KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 146KB - Virtual size: 145KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 228B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ