be7b5590ad4199e9a3bae6cac2475bdd | Triage

Sharing

Copy URL Twitter E-mail

General

Target

be7b5590ad4199e9a3bae6cac2475bdd
Size

188KB
MD5

be7b5590ad4199e9a3bae6cac2475bdd
SHA1

562024274c950b39da33826cf015d7e372d0f3e2
SHA256

c11023a4b7d65c8b2ce84fc2156b818c12256943bfab2d16ff74c377c6fbd754
SHA512

969ffea1cafad36301c3f9af7961e7a021659c087d8dfd1f3107251b373575ccf42a600fbc02f457ea55d5701231bbf072ec5dd20cbebc18f6f66701c0023cee
SSDEEP

3072:ChYiCQXKgH7xFjsDlyk+AZ6cGdgwQDDu15/aE8tqgrkVCuLnT:k7xFGlyfAZ5DDuLyozT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
be7b5590ad4199e9a3bae6cac2475bdd

Files

be7b5590ad4199e9a3bae6cac2475bdd
.dll windows:5 windows x86 arch:x86

8fb9c33d660a73e17ccb39e76d1e6039

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

RegLoadAppKeyA
RegisterServiceCtrlHandlerA

crypt32

CryptFreeOIDFunctionAddress

gdi32

CreateColorSpaceA

winmm

waveOutGetPitch

setupapi

SetupCloseInfFile

mprapi

MprAdminMIBEntryGetNext

msvcrt

memset
strlen

ntdsapi

DsBindWithCredW

oleaut32

VarR8FromCy
VarDecFromR8

user32

UnionRect
ShowOwnedPopups

kernel32

GetModuleHandleW
LoadLibraryExA
GetModuleFileNameA
FindActCtxSectionGuid
GetGeoInfoW
Sleep

Exports

Exports

WeprmcFosller

Sections

.text
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 124KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ