459f0d117d0b8854d5e1e60c037465e85afa41b4e46b8ec1158927aec36fd000

Sharing

Copy URL Twitter E-mail

General

Target

459f0d117d0b8854d5e1e60c037465e85afa41b4e46b8ec1158927aec36fd000
Size

27KB
MD5

d3089007f2c32f5b995d7756684164a3
SHA1

1b74eebf35d91a1fc12a5b90dbaaa3c349589ad1
SHA256

459f0d117d0b8854d5e1e60c037465e85afa41b4e46b8ec1158927aec36fd000
SHA512

ad492f135aabe841c809949e142bd2399cbe926f861a8a0637f84f099853e744b4d1d0b59828acb9f018c77d52c3cafb7574683803394c1b9261a86ad914ac1d
SSDEEP

384:a4DeDw4U9cJDi9yLNXSOJiV9cAkTT7/JRmgMtNIpUNig/encAEbeOAXbsNqc:7DOJy9c7Rmg4ycSOAX6p

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
459f0d117d0b8854d5e1e60c037465e85afa41b4e46b8ec1158927aec36fd000

Files

459f0d117d0b8854d5e1e60c037465e85afa41b4e46b8ec1158927aec36fd000
.dll regsvr32 windows:6 windows x64 arch:x64

a696aa3b782ba4ef27ef9e7569a31a9f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

G:\jenkins\workspace\Git-NLEPlatformPro\Src\SymbolTable\Win\x64_Release\NLEKeyBoardProcess.pdb

Imports

nlekey

?kScale@Speed@NLEKey@@3PEB_WEB
?kStrFileFullPath@Base@NLEKey@@3PEB_WEB
?kRender_Framerate@Render@NLEKey@@3PEB_WEB
?kSourceRender_CurrentKeybStreamIndex@SourceRender@NLEKey@@3PEB_WEB

nlecommon

?GetFactory@NLECommon@@YA?AV?$NLEComPtr@VINLEFactory@@@@PEB_W@Z
?PTSToFrameNumber@NLECommon@@YAH_JN@Z
?GetInterface@NLECommon@@YAJAEBU_GUID@@PEAUIUnknown@@K0PEAPEAX@Z

kernel32

OutputDebugStringW
GetFileAttributesW
GetModuleFileNameW
InitializeCriticalSectionEx
lstrlenW
GetLastError
DecodePointer
DeleteCriticalSection
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
EncodePointer
IsProcessorFeaturePresent

advapi32

RegSetValueExW
RegEnumKeyExW
RegOpenKeyExW
RegDeleteKeyW
RegSetValueW
RegCreateKeyW
RegCloseKey

ole32

StringFromGUID2

msvcr120

_CxxThrowException
_purecall
free
printf
_vsnwprintf
_lock
_unlock
memcpy
__dllonexit
__C_specific_handler
_onexit
__CppXcptFilter
_wcsicmp
_malloc_crt
_initterm
_initterm_e
__crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__crtCapturePreviousContext
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__clean_type_info_names_internal
??2@YAPEAX_K@Z
??3@YAXPEAX@Z
memmove
memset
_amsg_exit
__CxxFrameHandler3
_waccess
_calloc_crt

msvcp120

?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Winerror_map@std@@YAPEBDH@Z
?_Syserror_map@std@@YAPEBDH@Z

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a696aa3b782ba4ef27ef9e7569a31a9f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

nlekey

nlecommon

kernel32

advapi32

ole32

msvcr120

msvcp120

Exports

Exports

Sections

.text Size: 14KB - Virtual size: 13KB

.rdata Size: 9KB - Virtual size: 8KB

.data Size: 1024B - Virtual size: 2KB

.pdata Size: 1KB - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 512B - Virtual size: 192B

.text
Size: 14KB - Virtual size: 13KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 1024B - Virtual size: 2KB

.pdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 192B