e199e7f4101019d7c06187df1561b9a4 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e199e7f4101019d7c06187df1561b9a4
Size

416KB
MD5

e199e7f4101019d7c06187df1561b9a4
SHA1

280b257276591d5eaa7e963e5446bccfbac72537
SHA256

6619807854d257b7806d9ebd34e25d97fccba2b31c7bb5363992558fe6712e68
SHA512

96e4d9bc6f8b46f16e6b8326f7fb8bbd80e9d510be7f075639f9fa257f17dc49272251780732f1ad9c9c02bb1bc93c76b86c5f7943e187bb0bc45cb0226e2561
SSDEEP

12288:GbCggR5CkM3niXQA/cvaXTRZboLrjn1DxEIodKjBxWS4n3d:GbCggR5xSiCPs6wN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e199e7f4101019d7c06187df1561b9a4

Files

e199e7f4101019d7c06187df1561b9a4
.dll windows:4 windows x86 arch:x86

6da3c8863031d0aa039c27b81fba04e1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\src\producersdk\plugins\transform\audioresampler\rel32\audioresampler.pdb

Imports

kernel32

CreateMutexA
CloseHandle
WaitForSingleObject
ReleaseMutex
FreeLibrary
SetErrorMode
LoadLibraryA
DisableThreadLibraryCalls
GetProcAddress

msvcr71

tolower
isupper
strncpy
free
malloc
memmove
ceil
__dllonexit
_onexit
_initterm
_adjust_fdiv
__CppXcptFilter
_except_handler3
_CIpow
_purecall
??3@YAXPAX@Z
??2@YAPAXI@Z
calloc
_stricmp
_putenv
strchr
sprintf

Exports

Exports

RMACreateInstance
RMAShutdown
SetDLLAccessPath

Sections

.text
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 256KB - Virtual size: 256KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ