c4d15b72907abdffdf934d730deb9277 | Triage

Sharing

General

Target

c4d15b72907abdffdf934d730deb9277
Size

239KB
MD5

c4d15b72907abdffdf934d730deb9277
SHA1

f5b465aa6be7592057967c77d4ffcf5c7262c44c
SHA256

9efe6f36bd592c875467c57b1f413a3c8e488f3ca211e74fa9db9b4acc891fa6
SHA512

0812d9c8163a1e27296d9457fd78779034ad6498194bc3fa863307de6c79b01c3765149aad727b09a11cf7e4c635610687be32964eda0989904301197dc77926
SSDEEP

6144:1RlRUtrf4RRT+awNqpKohpb7EUwtqvgGT24s3AVLAaWMCV4jPzxHQu:1nGFuRW0NVQtOgFFWWMfjLdQu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c4d15b72907abdffdf934d730deb9277

Files

c4d15b72907abdffdf934d730deb9277
.dll regsvr32 windows:6 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

DllRegisterServer
DllUnregisterServer
EhvwwyqzzLvcghzzjzncdpn
NcqvrxpjFaqpogvdYvcpigrgbg
ResumeServer
StartServer
StartW
StopServer
SuspendServer

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 691B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tdata
Size: 230KB - Virtual size: 230KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE