c814bd18c2e9b0082e1183ebb8e27f61

Sharing

Copy URL Twitter E-mail

General

Target

c814bd18c2e9b0082e1183ebb8e27f61
Size

10KB
MD5

c814bd18c2e9b0082e1183ebb8e27f61
SHA1

c3c39a5b2f615c81eb8f66cf7856e1cdb8c2707c
SHA256

728e5daf885a4576b399b3edf87f2bf046d5d18adb1df6671f3714244de68667
SHA512

a861c09107d8c06bca26e0c78b96e52945cef0c569a9cd4d5c3e8490ba38bdf184c0e372872d7cc8ed8ed62d5ce76c28f9296510a595d314fe47fc152e331c92
SSDEEP

192:znmSFkLJuQffW8XZPIwBjOH8B9oVSQHniGgLO7cHu:zntkfesI8jtrHQr7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c814bd18c2e9b0082e1183ebb8e27f61

Files

c814bd18c2e9b0082e1183ebb8e27f61
.dll windows:6 windows x86 arch:x86

554331261a18e024190d1934adf3df3e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\桌面\study\shellcode_dll\Release\shellcode_dll.pdb

Imports

kernel32

WriteProcessMemory
ResumeThread
ExitThread
CloseHandle
GetThreadContext
VirtualAllocEx
CreateProcessA
SetThreadContext
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter

vcruntime140

memset
_except_handler4_common
__std_type_info_destroy_list

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf
__acrt_iob_func

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll
_initterm_e
_initterm
_execute_onexit_table
_cexit
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table

Exports

Exports

inject

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 892B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 356B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

554331261a18e024190d1934adf3df3e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 4KB - Virtual size: 3KB

.bss Size: - Virtual size: 892B

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 1KB - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 248B

.reloc Size: 512B - Virtual size: 356B

.text
Size: 4KB - Virtual size: 3KB

.bss
Size: - Virtual size: 892B

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 248B

.reloc
Size: 512B - Virtual size: 356B