rundll322[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

rundll322.exe
Size

52KB
MD5

543c8a2961f38c20438a61b9455e914c
SHA1

d07540f29c13983bc0eee943f0d19968d9a0fa7a
SHA256

58b5e00312deee5474cf42f0c86664254ae7123055219c342a80ab5754e48bf6
SHA512

27f2eb0ac8479409c516208da351308f01e642991916c06e1c3047a6b0539f8e854155bed55bb75a63425875ba745472b9c4ffa45d7825403c18e453bcf941db
SSDEEP

768:/3QELd2lpvI4L/NN66tLzRpbSEln5IyYpamDjobj8S:fQg2XI8NN1LzRjln5IUmDjoX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rundll322.exe

Files

rundll322.exe
.exe windows:10 windows x86 arch:x86

a2e75c292b8bfca7b2a1a8467befeecf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

rundll32.pdb

Imports

msvcrt

_controlfp
_amsg_exit
?terminate@@YAXXZ
_initterm
__CxxFrameHandler3
_except_handler4_common
_wcmdln
_wtoi
_lock
_unlock
__dllonexit
_onexit
__wgetmainargs
__set_app_type
__p__fmode
_cexit
_exit
exit
__p__commode
_XcptFilter
free
_purecall
_vsnwprintf
__setusermatherr
_callnewh
malloc
memset

api-ms-win-core-processthreads-l1-1-2

CreateProcessW
ExitProcess
GetCurrentProcessId
SetProcessMitigationPolicy
GetStartupInfoW
GetCurrentProcess
TerminateProcess
GetCurrentThreadId

api-ms-win-core-processenvironment-l1-2-0

GetCommandLineW
SearchPathW

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-path-l1-1-0

PathCchAppend

api-ms-win-core-sysinfo-l1-2-1

GetNativeSystemInfo
GetSystemTimeAsFileTime
GetSystemDirectoryW
GetTickCount

api-ms-win-core-file-l1-2-1

ReadFile
SetFilePointer
GetFileAttributesW
CreateFileW

api-ms-win-core-com-l1-1-1

CoAddRefServerProcess
CoCreateInstance
CLSIDFromString
CoRevokeClassObject
CoInitializeSecurity
CoWaitForMultipleHandles
CoReleaseServerProcess
CoInitializeEx
CoUninitialize
CoRegisterClassObject
CoResumeClassObjects

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
SetErrorMode

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
LoadStringW
GetProcAddress
GetModuleHandleA
GetModuleHandleW
LoadLibraryExW

api-ms-win-core-synch-l1-2-0

CreateEventW
SetEvent
Sleep
WaitForSingleObject
AcquireSRWLockShared
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive

api-ms-win-core-winrt-error-l1-1-1

RoOriginateError
RoOriginateErrorW

api-ms-win-core-string-l1-1-0

CompareStringW
WideCharToMultiByte

api-ms-win-core-console-l2-1-0

AttachConsole
FreeConsole

api-ms-win-core-localization-l1-2-1

FormatMessageW

api-ms-win-core-console-l1-1-0

WriteConsoleW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-heap-l1-2-0

HeapSetInformation

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-kernel32-private-l1-1-2

Wow64EnableWow64FsRedirection

api-ms-win-core-sidebyside-l1-1-0

DeactivateActCtx
QueryActCtxW
ReleaseActCtx
ActivateActCtx
CreateActCtxW

api-ms-win-downlevel-shlwapi-l1-1-1

PathIsRelativeW

api-ms-win-downlevel-shlwapi-l2-1-1

SHSetThreadRef

imagehlp

ImageDirectoryEntryToData

ntdll

NtSetInformationToken
NtClose
NtOpenProcessToken
RtlNtStatusToDosError
NtQueryInformationToken
RtlSetSearchPathMode
RtlImageNtHeader
NtSetInformationProcess

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a2e75c292b8bfca7b2a1a8467befeecf

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-file-l1-2-1

api-ms-win-core-com-l1-1-1

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-console-l2-1-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-console-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-wow64-l1-1-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-kernel32-private-l1-1-2

api-ms-win-core-sidebyside-l1-1-0

api-ms-win-downlevel-shlwapi-l1-1-1

api-ms-win-downlevel-shlwapi-l2-1-1

imagehlp

ntdll

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-apiquery-l1-1-0

Sections

.text Size: 18KB - Virtual size: 17KB

.data Size: 512B - Virtual size: 992B

.idata Size: 5KB - Virtual size: 4KB

.didat Size: 512B - Virtual size: 132B

.rsrc Size: 26KB - Virtual size: 25KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 18KB - Virtual size: 17KB

.data
Size: 512B - Virtual size: 992B

.idata
Size: 5KB - Virtual size: 4KB

.didat
Size: 512B - Virtual size: 132B

.rsrc
Size: 26KB - Virtual size: 25KB

.reloc
Size: 1KB - Virtual size: 1KB