decdf8d2a0c2ff4e5396ba958ba7146c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

decdf8d2a0c2ff4e5396ba958ba7146c
Size

47KB
MD5

decdf8d2a0c2ff4e5396ba958ba7146c
SHA1

f08b7c279fce7569423c6a0729527b71b4f7872f
SHA256

bdc8bedcb6801877b0aab93673b93d1634cb9177104b110dbe07b8d5ddbb56d0
SHA512

3e7b4ed4f4a39668dc20690e5faf72f09e35b61e6e339c4911c6702ac5a211859e70a8f22ea7bc658076ee17327306c368f161f15a30a4fbd74ec03a8ac664ad
SSDEEP

768:Wj+YbSVMqQzf+Qky8EjF8PfNWeUS2qz7iHCjMAAvTnJwDo9StM7h8JR8HFE:5YuVMqsf+Q/nF8Pgqz7iHCj/ATJ3IFJf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
decdf8d2a0c2ff4e5396ba958ba7146c

Files

decdf8d2a0c2ff4e5396ba958ba7146c
.dll regsvr32 windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
JmpHookOff
JmpHookOn

Sections

CODE
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1024B - Virtual size: 736B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 2KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 202B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.MaskPE
Size: 512B - Virtual size: 130B

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ