9de29c1fe2ccadd63938180565fdcbcc | Triage

Sharing

Copy URL Twitter E-mail

General

Target

9de29c1fe2ccadd63938180565fdcbcc
Size

9KB
MD5

9de29c1fe2ccadd63938180565fdcbcc
SHA1

1adb2ad5519328de22fe03472097cf90526b9ebb
SHA256

cac6b9bc2175e7cb3e6be982b431a99c96b2b26538f1db2f93cb71c13843f949
SHA512

a0dea6798e5e1725a6b3a1f8caa671f99b99217fd9f5d359f86b2ee4c90782121ef556909d722813a14d82b7a4db2a27a7ae6571d5b931a68dd93feae4770ae8
SSDEEP

192:98xSJ1nHVUmrcQXEGMlLOYLsGZ90YK6pOm7cfBP5XT:y8XnHVnHXE7xOYL70YcBhD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9de29c1fe2ccadd63938180565fdcbcc

Files

9de29c1fe2ccadd63938180565fdcbcc
.dll windows:6 windows x86 arch:x86

4a1afc3df86c0053b6d886d87ed08481

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\programs\siberia\wlloader\objfre_wxp_x86\i386\WLLoader.pdb

Imports

kernel32

CreateProcessA
CloseHandle
WriteFile
CreateFileA
GetTempFileNameA
GetTempPathA
ResumeThread
SetThreadContext
WriteProcessMemory
VirtualAllocEx
ReadProcessMemory
GetThreadContext
Sleep
GetEnvironmentVariableA
WaitForSingleObject
CreateThread
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
QueryPerformanceCounter
HeapFree
GetProcessHeap
lstrcatA
HeapAlloc
RtlUnwind

advapi32

RegQueryValueExA
RegSetValueExA
RegCloseKey
RegCreateKeyA

ws2_32

recv
send
connect
htons
socket
WSACleanup
WSAStartup
closesocket

Exports

Exports

Run
WLEventStartShell

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 420B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ