cb603adae987e6fd259b989fd4fe52ad

Sharing

Copy URL Twitter E-mail

General

Target

cb603adae987e6fd259b989fd4fe52ad
Size

115KB
MD5

cb603adae987e6fd259b989fd4fe52ad
SHA1

090e3425559c66e56489fc94157d30af8a0fc20b
SHA256

f678481482a832e77469c0e7bab63d1280ce83c9195693a4e37030ba70e4d98b
SHA512

9333a23f8d45630460cdb901d9d6f75da48766d3de4ea889f25d575bea8355af905d067cdc54acdbaa92f24a9a037073ebdef361a70a98650a9974325a41745b
SSDEEP

1536:eLMYNJJklqDOt1llzx7XJzso4jkU2RNkO5kggYd4pc5nd3VdfKvY+N+zFP2cy+r2:wMYFaqDOt1vV7Xxw03R5cBw+YEcy287

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cb603adae987e6fd259b989fd4fe52ad

Files

cb603adae987e6fd259b989fd4fe52ad
.dll windows:5 windows x86 arch:x86

150195402fa84198d88a7edd5349d6ee

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\build\source\rpbrowserrecordplugin\rel32\nprphtml5videoshim.pdb

Imports

kernel32

GetProcAddress
LoadLibraryA
VirtualAlloc
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
UnhandledExceptionFilter

user32

MessageBoxA

msvcr90

_invalid_parameter_noinfo
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
??2@YAPAXI@Z
_purecall
__CxxFrameHandler3
free
??1exception@std@@UAE@XZ
_encode_pointer
_malloc_crt
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_unlock
__dllonexit
_lock
_onexit
_crt_debugger_hook
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
_except_handler4_common
??0exception@std@@QAE@XZ
??3@YAXPAX@Z
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
memset

msvcp90

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z

Exports

Exports

NP_GetEntryPoints
NP_Initialize
NP_Shutdown

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 98KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

150195402fa84198d88a7edd5349d6ee

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

msvcr90

msvcp90

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 8KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 98KB - Virtual size: 98KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 8KB - Virtual size: 8KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 98KB - Virtual size: 98KB

.reloc
Size: 2KB - Virtual size: 1KB