c72f766d1d65ed42ce032cc37dade5e9

Sharing

Copy URL Twitter E-mail

General

Target

c72f766d1d65ed42ce032cc37dade5e9
Size

48KB
MD5

c72f766d1d65ed42ce032cc37dade5e9
SHA1

f37fb72579d8a566994d0673d6cd7d8657bec4d2
SHA256

83d0f6a19c23933d85a29f4c6fae5233c3537c1edba9193e450c9a862011ff6f
SHA512

34d6a3033928f16d21704acfe8b38d83cce2d83316dfa3e430d27e9915f3fa080fa00ac42a7e0af62ffe51014cb79756d7a86f2d42dee5827e40cac223793eab
SSDEEP

768:+fhmqcQ3cGcpd2ayPZqeG5ACaruKZpGjtspHyqTc0y98TJ7jumNxalZk7:whzc9Lk7fCaLZCt2VcJa7VNsZc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c72f766d1d65ed42ce032cc37dade5e9

Files

c72f766d1d65ed42ce032cc37dade5e9
.dll regsvr32 windows:4 windows x86 arch:x86

47fa9bd0376cbbe51477c913eefda6b5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetSystemDirectoryA
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
lstrlenW
MultiByteToWideChar
lstrlenA
GetShortPathNameA
GetModuleHandleA
WideCharToMultiByte
GetModuleFileNameA
FindNextFileA
DeleteFileA
SetFileAttributesA
GetPrivateProfileStringA
FindFirstFileA
CreateThread
MoveFileA
Process32Next
Process32First
GetCommandLineW
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetCurrentProcessId
FreeLibrary
CreateDirectoryA
CloseHandle
WritePrivateProfileStringA
Sleep
LoadLibraryA
GetProcAddress
LocalFree
EnterCriticalSection
LeaveCriticalSection
ExitProcess

user32

IsWindow
FindWindowExA
SetWindowTextA
SendMessageA

advapi32

BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegSetValueExA
RegCreateKeyExA
RegQueryInfoKeyA
RegDeleteKeyA
RegEnumKeyExA
GetNamedSecurityInfoA

shell32

SHGetSpecialFolderPathA
CommandLineToArgvW

ole32

CoInitialize
CoCreateInstance

oleaut32

VariantClear
SysAllocString
SysStringLen
LoadRegTypeLi
SysFreeString

msvcrt

strlen
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
atoi
_wcslwr
wcsstr
strstr
memcmp
??2@YAPAXI@Z
_purecall
memcpy
strrchr
strcmp
??3@YAXPAX@Z
memset
sprintf
strncpy
strchr
strncmp
_strupr
strcpy
strcat
_access

shlwapi

SHSetValueA
SHDeleteKeyA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

cdata
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

47fa9bd0376cbbe51477c913eefda6b5

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

msvcrt

shlwapi

Exports

Exports

Sections

.text Size: 24KB - Virtual size: 22KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 4KB - Virtual size: 2KB

cdata Size: 4KB - Virtual size: 4B

.rsrc Size: 4KB - Virtual size: 2KB

.reloc Size: 4KB - Virtual size: 1KB

.text
Size: 24KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 4KB - Virtual size: 2KB

cdata
Size: 4KB - Virtual size: 4B

.rsrc
Size: 4KB - Virtual size: 2KB

.reloc
Size: 4KB - Virtual size: 1KB