bfa82a291cd378da7b35e903dbbb1457 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bfa82a291cd378da7b35e903dbbb1457
Size

101KB
MD5

bfa82a291cd378da7b35e903dbbb1457
SHA1

0103a029d6c3ef6665f5e77fb47d7b3940b3a6df
SHA256

736d296dad65382738027790283e8aed7bf18480371196c44ca2ea50770f28df
SHA512

837a60f1889b7deff2fa1df9f073bea9b6fc43c3d391e1ad32b28e465d9a4233269cb740ddf7705771bf9dad8997dd24d578a3f1f7c911b55fc80608663a84b4
SSDEEP

3072:t/3AqfXeNqeyrX4TLgiAkZEuUm3svHfRYcML6N+jCHt:t/3AqfOcxiLtDrDcnRYX6N+jC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bfa82a291cd378da7b35e903dbbb1457

Files

bfa82a291cd378da7b35e903dbbb1457
.dll regsvr32 windows:4 windows x86 arch:x86

1a729f49bacf0c764fda536087c72fba

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetBinaryType
ReadProcessMemory
ReplaceFile
GetLongPathNameW
LoadLibraryExA
GetProcAddress
GlobalFindAtomW

advapi32

FreeSid

oleaut32

SysFreeString

user32

CharNextA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
Oblgdop
DllMain
DllRegisterServer
DllUnregisterServer
ServiceMain

Sections

.text
Size: 97KB - Virtual size: 272KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 428B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 224B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_MEM_READ