ab0dd973835c15a27978b25179c7e20c7ce11f222aabf67e6365f24528e96865

Sharing

Copy URL Twitter E-mail

General

Target

ab0dd973835c15a27978b25179c7e20c7ce11f222aabf67e6365f24528e96865
Size

672KB
MD5

5dd63aa95ea61682771a5cb06fc3d3fd
SHA1

db14d3bb4f6047d4eec9d30e231dc2755f98002c
SHA256

ab0dd973835c15a27978b25179c7e20c7ce11f222aabf67e6365f24528e96865
SHA512

a8f1ef6d66d3765a7ecf1183d1bf3bff2f8ea1179a36299a17717b36951075d52c95ff44bd7d1230345712c173551d68a91b0c2ffa1642d2a2c17ad899f82bdb
SSDEEP

6144:SMzKfZMh8jiIhKzAZmGuUmlly/xcXe+zBKnpFLJI:DzKf6h8GIhuAZSUrx9L

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ab0dd973835c15a27978b25179c7e20c7ce11f222aabf67e6365f24528e96865

Files

ab0dd973835c15a27978b25179c7e20c7ce11f222aabf67e6365f24528e96865
.dll windows:4 windows x86 arch:x86

8015f55fdf171c74106673e744c1222a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL

Imports

xpphrfp

XPPHTMLPARSERGETSTREAMTYPE
XPPHTMLPARSERGETTAGCLASS
XPPHTMLPARSERNEW
XPPHTMLPARSERSTART
XPPHTMLPARSERDELETE
XPPHTMLPARSERCREATETAGS
XPPHTMLTOSTRING
XPPSTRINGTOHTML

xpprt1

?prepareOpStack
?ehIsError
?ehSetContext
?setjmp
?exeNativeError
?exeStackUnwind
?momSOn
?conNewNil
?symContextInit
__vft18ConUndefinedObject10AtomObject
?conNAllocL
?momSOff
ARRAY
?domRefElem
?conNewString
REPLICATE
?retNil
?conNRelease
?conNReleaseL
?frameExit
?ehUnwind
?domAssign
?nomClassLock
?nomTryFindRegisteredClass
?retObject
?nomClassUnlock
?nomCreateClass
?nomDefineVar
?nomDefineMethod
?nomDefineVarMethod
?nomEndClassDefinition
?nomRegisterClass
?nomCallInitClass
?conRelease
?passParameter
?conGetSelfClass
?conGetClass
?retStackItem
?conAssignRefWMember
SPACE
CHR
?domAdd
?domAddEqu
?domValNEql
?conMemberToItem
?retStackValue
?conSendItem
?domValXEql
ACREATE
ALLTRIM
EMPTY
?domNot
AADD
ASCAN
?symRefItemConst
?getRFPC
?domSubStr
?domXEql
?andShortCut
?domGetElem
?domAnd
?orShortCut
?domOr
?executeMacro
__vft19ConNumericIntObject10AtomObject
VALTYPE
?domLCmp
LEN
?domGCmp
PROCNAME
QOUT
PROCLINE
_QUIT
ADEL
ASIZE
?domNEql
ACLONE
?conNewCon
UPPER
?pushDynamicCodeBlock
?domSub
__vft20ConStringConstObject10AtomObject
?domMul
?conOpNewInt
STUFF
SUBSTR
STR
LTRIM
DTOC
VAL
CTOD
?domInc
?domLECmp
?domValSubStr
?nomRedefineMethodOfClass
__vft21ConNumericFloatObject10AtomObject
__vft14ConLogicObject10AtomObject
EVAL
MEMOREAD
?floadTos
SET
AT
TONE
OUTSTD
ISMEMBERVAR
FCREATE
FWRITE
FCLOSE
DLLLOAD
DLLCALL
VAR2LCHAR
STRTRAN
DLLUNLOAD
?conNNewNil
RAT
AEVAL
ACOPY
SECONDS
?frameLockSync
?momUnlockSync
?symPrivateConst
_osiDllRemove
_osiDllInsert
__This_DLL_needs_version_2_00_0

Exports

Exports

DOCUMENT
ELEMENT
HRFATTRIBUTECONTAINER
HRFCOLLECTREC
HRFCONVERTTOCODEPAGE
HRFCONVERTTOHTML
HRFEVALREC
HRFGETFORM
HRFLOADDOCUMENT
HRFPRINTTAGNAMES
HRFREPLACEID
HRFSCANREC
HRFTAG
HRFTEXT
HRFUNKNOWN
HTMLANCHORELEMENT
HTMLAPPLETELEMENT
HTMLAREAELEMENT
HTMLBASEELEMENT
HTMLBASEFONTELEMENT
HTMLBLOCKQUOTEELEMENT
HTMLBODYELEMENT
HTMLBRELEMENT
HTMLBUTTONELEMENT
HTMLCODE
HTMLCOLLECTION
HTMLDIRECTORYELEMENT
HTMLDIVELEMENT
HTMLDLISTELEMENT
HTMLDOCUMENT
HTMLELEMENT
HTMLFIELDSETELEMENT
HTMLFONTELEMENT
HTMLFORMELEMENT
HTMLFRAMEELEMENT
HTMLFRAMESETELEMENT
HTMLHEADELEMENT
HTMLHEADINGELEMENT
HTMLHRELEMENT
HTMLHTMLELEMENT
HTMLIFRAMEELEMENT
HTMLIMAGEELEMENT
HTMLINPUTELEMENT
HTMLISINDEXELEMENT
HTMLLABELELEMENT
HTMLLEGENDELEMENT
HTMLLIELEMENT
HTMLLINKELEMENT
HTMLMAPELEMENT
HTMLMENUELEMENT
HTMLMETAELEMENT
HTMLMODELEMENT
HTMLOBJECTELEMENT
HTMLOLISTELEMENT
HTMLOPTGROUPELEMENT
HTMLOPTIONELEMENT
HTMLPARAGRAPHELEMENT
HTMLPARAMELEMENT
HTMLPREELEMENT
HTMLQUOTEELEMENT
HTMLSCRIPTELEMENT
HTMLSELECTELEMENT
HTMLSTYLEELEMENT
HTMLTABLECAPTIONELEMENT
HTMLTABLECELLELEMENT
HTMLTABLECOLELEMENT
HTMLTABLEELEMENT
HTMLTABLEROWELEMENT
HTMLTABLESECTIONELEMENT
HTMLTEXTAREAELEMENT
HTMLTITLEELEMENT
HTMLULISTELEMENT

Sections

.text
Size: 580KB - Virtual size: 579KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xpp
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8015f55fdf171c74106673e744c1222a

Headers

File Characteristics

Imports

xpphrfp

xpprt1

Exports

Exports

Sections

.text Size: 580KB - Virtual size: 579KB

.data Size: 52KB - Virtual size: 52KB

.xpp Size: 7KB - Virtual size: 6KB

.edata Size: 2KB - Virtual size: 1KB

.idata Size: 3KB - Virtual size: 3KB

.rsrc Size: 1024B - Virtual size: 840B

.reloc Size: 25KB - Virtual size: 24KB

.text
Size: 580KB - Virtual size: 579KB

.data
Size: 52KB - Virtual size: 52KB

.xpp
Size: 7KB - Virtual size: 6KB

.edata
Size: 2KB - Virtual size: 1KB

.idata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 1024B - Virtual size: 840B

.reloc
Size: 25KB - Virtual size: 24KB