2nd_stage_1 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2nd_stage_1
Size

45KB
MD5

5382fdbf72da1e8cdd72aed3e8f83cff
SHA1

45cddd021d9edc772f8864aedf2955b4623bd7ec
SHA256

58dd469cf501244fac2c8f22b62f35f361543bf3516843083aafaef4bcaacf30
SHA512

e26e506ec4cb083c4736f38b3da9bc3daccda375958247ba85f265fc3d6b09349942a6a491251b20e2f911152dc13030adcaa8383956f185128903ea8e3802eb
SSDEEP

768:fAzBPOX8KhSyZ5g1moMEPI8q9LSg1P7feC9z0o:kBPc8qSyZ8MEA8q9LSYPDeezP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2nd_stage_1

Files

2nd_stage_1
.dll regsvr32 windows:6 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

ClearPropVariantArray
ClearVariantArray
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProxyDllInfo
InitPropVariantFromBooleanVector
InitPropVariantFromBuffer
InitPropVariantFromCLSID
InitPropVariantFromDoubleVector
InitPropVariantFromFileTime
InitPropVariantFromFileTimeVector
InitPropVariantFromGUIDAsString
InitPropVariantFromInt16Vector
InitPropVariantFromInt32Vector
InitPropVariantFromInt64Vector
InitPropVariantFromPropVariantVectorElem
InitPropVariantFromResource
InitPropVariantFromStrRet
InitPropVariantFromStringAsVector
InitPropVariantFromStringVector
InitPropVariantFromUInt16Vector
InitPropVariantFromUInt32Vector
InitPropVariantFromUInt64Vector
InitPropVariantVectorFromPropVariant
InitVariantFromBooleanArray
InitVariantFromBuffer
InitVariantFromDoubleArray
InitVariantFromFileTime
InitVariantFromFileTimeArray
InitVariantFromGUIDAsString
InitVariantFromInt16Array
InitVariantFromInt32Array
InitVariantFromInt64Array
InitVariantFromResource
InitVariantFromStrRet
InitVariantFromStringArray
InitVariantFromUInt16Array
InitVariantFromUInt32Array
InitVariantFromUInt64Array
InitVariantFromVariantArrayElem
PSCoerceToCanonicalValue
PSCreateAdapterFromPropertyStore
PSCreateDelayedMultiplexPropertyStore
PSCreateMemoryPropertyStore
PSCreateMultiplexPropertyStore
PSCreatePropertyChangeArray
PSCreatePropertyStoreFromObject
PSCreatePropertyStoreFromPropertySetStorage
PSCreateSimplePropertyChange
PSEnumeratePropertyDescriptions
PSFormatForDisplay
PSFormatForDisplayAlloc
PSFormatForDisplayAllocs
PSFormatPropertyValue
PSGetImageReferenceForValue
PSGetItemPropertyHandler
PSGetItemPropertyHandlerWithCreateObject
PSGetNameFromPropertyKey
PSGetNamedPropertyFromPropertyStorage
PSGetPropertyDescription
PSGetPropertyDescriptionByName
PSGetPropertyDescriptionListFromString
PSGetPropertyFromPropertyStorage
PSGetPropertyKeyFromName
PSGetPropertySystem
PSGetPropertyValue
PSLookupPropertyHandlerCLSID
PSPropertyBag_Delete
PSPropertyBag_ReadBOOL
PSPropertyBag_ReadBSTR
PSPropertyBag_ReadDWORD
PSPropertyBag_ReadGUID
PSPropertyBag_ReadInt
PSPropertyBag_ReadLONG
PSPropertyBag_ReadPOINTL
PSPropertyBag_ReadPOINTS
PSPropertyBag_ReadPropertyKey
PSPropertyBag_ReadRECTL
PSPropertyBag_ReadSHORT
PSPropertyBag_ReadStr
PSPropertyBag_ReadStrAlloc
PSPropertyBag_ReadStream
PSPropertyBag_ReadType
PSPropertyBag_ReadULONGLONG
PSPropertyBag_ReadUnknown
PSPropertyBag_WriteBOOL
PSPropertyBag_WriteBSTR
PSPropertyBag_WriteDWORD
PSPropertyBag_WriteGUID
PSPropertyBag_WriteInt
PSPropertyBag_WriteLONG
PSPropertyBag_WritePOINTL
PSPropertyBag_WritePOINTS
PSPropertyBag_WritePropertyKey
PSPropertyBag_WriteRECTL
PSPropertyBag_WriteSHORT
PSPropertyBag_WriteStr
PSPropertyBag_WriteStream
PSPropertyBag_WriteULONGLONG
PSPropertyBag_WriteUnknown
PSPropertyKeyFromString
PSRefreshPropertySchema
PSRegisterPropertySchema
PSSetPropertyValue
PSStringFromPropertyKey
PSUnregisterPropertySchema
PropVariantChangeType
PropVariantCompareEx
PropVariantGetBooleanElem
PropVariantGetDoubleElem
PropVariantGetElementCount
PropVariantGetFileTimeElem
PropVariantGetInt16Elem
PropVariantGetInt32Elem
PropVariantGetInt64Elem
PropVariantGetStringElem
PropVariantGetUInt16Elem
PropVariantGetUInt32Elem
PropVariantGetUInt64Elem
PropVariantToBSTR
PropVariantToBoolean
PropVariantToBooleanVector
PropVariantToBooleanVectorAlloc
PropVariantToBooleanWithDefault
PropVariantToBuffer
PropVariantToDouble
PropVariantToDoubleVector
PropVariantToDoubleVectorAlloc
PropVariantToDoubleWithDefault
PropVariantToFileTime
PropVariantToFileTimeVector
PropVariantToFileTimeVectorAlloc
PropVariantToGUID
PropVariantToInt16
PropVariantToInt16Vector
PropVariantToInt16VectorAlloc
PropVariantToInt16WithDefault
PropVariantToInt32
PropVariantToInt32Vector
PropVariantToInt32VectorAlloc
PropVariantToInt32WithDefault
PropVariantToInt64
PropVariantToInt64Vector
PropVariantToInt64VectorAlloc
PropVariantToInt64WithDefault
PropVariantToStrRet
PropVariantToString
PropVariantToStringAlloc
PropVariantToStringVector
PropVariantToStringVectorAlloc
PropVariantToStringWithDefault
PropVariantToUInt16
PropVariantToUInt16Vector
PropVariantToUInt16VectorAlloc
PropVariantToUInt16WithDefault
PropVariantToUInt32
PropVariantToUInt32Vector
PropVariantToUInt32VectorAlloc
PropVariantToUInt32WithDefault
PropVariantToUInt64
PropVariantToUInt64Vector
PropVariantToUInt64VectorAlloc
PropVariantToUInt64WithDefault
PropVariantToVariant
PropVariantToWinRTPropertyValue
StgDeserializePropVariant
StgSerializePropVariant
VariantCompare
VariantGetBooleanElem
VariantGetDoubleElem
VariantGetElementCount
VariantGetInt16Elem
VariantGetInt32Elem
VariantGetInt64Elem
VariantGetStringElem
VariantGetUInt16Elem
VariantGetUInt32Elem
VariantGetUInt64Elem
VariantToBoolean
VariantToBooleanArray
VariantToBooleanArrayAlloc
VariantToBooleanWithDefault
VariantToBuffer
VariantToDosDateTime
VariantToDouble
VariantToDoubleArray
VariantToDoubleArrayAlloc
VariantToDoubleWithDefault
VariantToFileTime
VariantToGUID
VariantToInt16
VariantToInt16Array
VariantToInt16ArrayAlloc
VariantToInt16WithDefault
VariantToInt32
VariantToInt32Array
VariantToInt32ArrayAlloc
VariantToInt32WithDefault
VariantToInt64
VariantToInt64Array
VariantToInt64ArrayAlloc
VariantToInt64WithDefault
VariantToPropVariant
VariantToStrRet
VariantToString
VariantToStringAlloc
VariantToStringArray
VariantToStringArrayAlloc
VariantToStringWithDefault
VariantToUInt16
VariantToUInt16Array
VariantToUInt16ArrayAlloc
VariantToUInt16WithDefault
VariantToUInt32
VariantToUInt32Array
VariantToUInt32ArrayAlloc
VariantToUInt32WithDefault
VariantToUInt64
VariantToUInt64Array
VariantToUInt64ArrayAlloc
VariantToUInt64WithDefault
WinRTPropertyValueToPropVariant

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 468B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Exports

Exports

Sections

.text Size: 6KB - Virtual size: 5KB

.rdata Size: 25KB - Virtual size: 25KB

.data Size: 512B - Virtual size: 520B

.pdata Size: 512B - Virtual size: 468B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 68B

.text
Size: 6KB - Virtual size: 5KB

.rdata
Size: 25KB - Virtual size: 25KB

.data
Size: 512B - Virtual size: 520B

.pdata
Size: 512B - Virtual size: 468B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 68B