c1a07b17cc87a6ce2027eaf34edc3312

Sharing

Copy URL Twitter E-mail

General

Target

c1a07b17cc87a6ce2027eaf34edc3312
Size

112KB
MD5

c1a07b17cc87a6ce2027eaf34edc3312
SHA1

0ec908fb17d282f9a0281379b5e2da1c0624b43f
SHA256

8cc7885865dda4c803e688018ca5daad36110264b2b1cf114476539eb58cd16c
SHA512

4d6ffa370708dd50443aac7b2f499f5bf343355e087427b6845e504e595721da8fe8a69be9c317359b13c30f8a4b84b380bc4b75015df60d20d3c1214917341a
SSDEEP

1536:sgGgpPl1y3euVan1sCseXG5qJJu8Senggj5xf0ASAxXDXUXiBZDlIQ:sgGgJPf25qjagj5x3z6MI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c1a07b17cc87a6ce2027eaf34edc3312

Files

c1a07b17cc87a6ce2027eaf34edc3312
.dll windows:4 windows x86 arch:x86

bfb96f8ea347949fb64011a72781a0a9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

s:\Dev\APOs\AEFilters\AEFiltersCom\Release-SigmaTel\AESTCom.pdb

Imports

advapi32

RegEnumKeyExW
RegOpenKeyW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
RegNotifyChangeKeyValue
OpenSCManagerW
OpenServiceW
CloseServiceHandle
StartServiceW

kernel32

SetFilePointer
GetModuleHandleW
GetModuleFileNameW
lstrlenW
WideCharToMultiByte
CreateThread
CreateEventW
SetThreadPriority
ResumeThread
SetEvent
WaitForSingleObject
CloseHandle
Sleep
WriteFile
CreateFileW
GetLastError
WaitForMultipleObjects
GetLocalTime
GetDateFormatW
GetTimeFormatW
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleA
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
HeapSize
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapReAlloc
VirtualAlloc
LoadLibraryA
InitializeCriticalSection
RtlUnwind
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
CreateFileA
FlushFileBuffers

Exports

Exports

AEGetBeamDirection
AEGetFilter
AEIsDirectionalBeamAvailable
AEIsDirectionalBeamSteeringAvailable
AEIsSpeakerPhoneAvailable
AEIsVoiceRecordingAvailable
AERegisterNotificationCallback
AESetBeamDirection
AESetFilter
AEUnregisterNotificationCallback

Sections

.text
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

bfb96f8ea347949fb64011a72781a0a9

Headers

File Characteristics

PDB Paths

Imports

advapi32

kernel32

Exports

Exports

Sections

.text Size: 40KB - Virtual size: 38KB

.rdata Size: 12KB - Virtual size: 10KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 4KB

.rsrc Size: 40KB - Virtual size: 40KB

.text
Size: 40KB - Virtual size: 38KB

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 4KB

.rsrc
Size: 40KB - Virtual size: 40KB