85ce5440918eedd446e7d60cc5b91be8

Sharing

Copy URL Twitter E-mail

General

Target

85ce5440918eedd446e7d60cc5b91be8
Size

68KB
MD5

85ce5440918eedd446e7d60cc5b91be8
SHA1

94eb3e8c9a6550d8c271e8aa2dc40eb42ebde541
SHA256

29b9b74ad8291c9225398757c8338271accf2e678df1147a6ba94c2ac17a3834
SHA512

5ae1e452455256f1d37997eec50c0dbf34184d9636587266bc95e8c8edbcc2abf5aa820255eb4aae935b13cfadf243999a3d95bbd6ae0e639973bef7f668fc82
SSDEEP

768:HYqZGH+Bb70AB1daee8LLky8baeYqYyKp6DXLj72FwmvGeAE1iGK:jZq+BEAn4e2zL7r2Fw5fE/K

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
85ce5440918eedd446e7d60cc5b91be8

Files

85ce5440918eedd446e7d60cc5b91be8
.dll regsvr32 windows:6 windows x86 arch:x86

c5deeecf650e84f774ab46e024c49b5e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\DOCUME~1\bld4act\LOCALS~1\Temp\Hpolaris\optPolaris\baseline\WMDMPS.pdb

Imports

msvcrt

_adjust_fdiv
_amsg_exit
_initterm
free
malloc
_XcptFilter

kernel32

DisableThreadLibraryCalls
InterlockedExchange
Sleep
InterlockedCompareExchange
RtlUnwind
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter

oleaut32

LPSAFEARRAY_UserFree
LPSAFEARRAY_UserUnmarshal
LPSAFEARRAY_UserMarshal
BSTR_UserSize
BSTR_UserMarshal
BSTR_UserUnmarshal
BSTR_UserFree
LPSAFEARRAY_UserSize

rpcrt4

NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
NdrDllRegisterProxy
NdrDllUnregisterProxy
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_CountRefs
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
CStdStubBuffer_Disconnect
CStdStubBuffer_Connect
CStdStubBuffer_AddRef
CStdStubBuffer_QueryInterface
IUnknown_Release_Proxy
IUnknown_AddRef_Proxy
IUnknown_QueryInterface_Proxy
NdrOleFree
NdrOleAllocate

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProxyDllInfo

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 1024B - Virtual size: 545B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c5deeecf650e84f774ab46e024c49b5e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

oleaut32

rpcrt4

Exports

Exports

Sections

.text Size: 26KB - Virtual size: 25KB

.orpc Size: 1024B - Virtual size: 545B

.data Size: 3KB - Virtual size: 4KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 26KB - Virtual size: 25KB

.orpc
Size: 1024B - Virtual size: 545B

.data
Size: 3KB - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 3KB