C:\mhc\jmde\Release32\rearoute.pdb
Static task
static1
Behavioral task
behavioral1
Sample
826f462046538e01b85f7d281fb3013d5fb404bf137bcf4fffc98f61a9a2b94d.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
826f462046538e01b85f7d281fb3013d5fb404bf137bcf4fffc98f61a9a2b94d.dll
Resource
win10v2004-20240226-en
General
-
Target
826f462046538e01b85f7d281fb3013d5fb404bf137bcf4fffc98f61a9a2b94d
-
Size
132KB
-
MD5
4e6ea28888962a0876dfb9df6531bfb5
-
SHA1
ef5126bbe9a39749c99f79ff32d28912da92e1ef
-
SHA256
826f462046538e01b85f7d281fb3013d5fb404bf137bcf4fffc98f61a9a2b94d
-
SHA512
67ff4b668a61d13c3f7f1c835e03475beaa18612a8d9962ad8506fed2ea9c4fc38295447cc3e1e47c8d77d104e2c48b9b1c4b94f297fd5ca08842092565a84bb
-
SSDEEP
1536:7S+SH1oEpAzfChxmIfWOKMkcgHZZIkUh0IPXloI5u/+N+qsUeZR162tAVvfaK:vEeboYc6I5umN+qsUeZR162tAVr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 826f462046538e01b85f7d281fb3013d5fb404bf137bcf4fffc98f61a9a2b94d
Files
-
826f462046538e01b85f7d281fb3013d5fb404bf137bcf4fffc98f61a9a2b94d.dll regsvr32 windows:4 windows x86 arch:x86
2a166a237a7b15771ebbed3e21f6df5f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
winmm
timeGetTime
kernel32
GetModuleFileNameA
Sleep
SetEvent
WaitForMultipleObjects
InterlockedDecrement
ReleaseMutex
InterlockedIncrement
CreateEventA
GetCurrentProcessId
CreateMutexA
GetVersion
WideCharToMultiByte
GetModuleHandleA
GetVersionExA
MapViewOfFile
lstrcpynA
WriteFile
GetPrivateProfileIntA
GetFileSize
CreateFileA
GetTempPathA
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
WritePrivateProfileStringA
SetThreadPriority
WaitForSingleObject
UnmapViewOfFile
CloseHandle
DeleteFileA
CreateFileMappingA
TlsSetValue
ExitThread
GetCurrentThreadId
GetLastError
CreateThread
RtlUnwind
HeapAlloc
GetCommandLineA
HeapFree
GetProcessHeap
GetProcAddress
TlsGetValue
TlsAlloc
TlsFree
SetLastError
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
GetStdHandle
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryA
InitializeCriticalSection
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapSize
MultiByteToWideChar
GetLocaleInfoA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
user32
IsDlgButtonChecked
DialogBoxParamA
CharLowerA
CheckDlgButton
SetDlgItemInt
EndDialog
GetDesktopWindow
GetDlgItemInt
GetFocus
MessageBoxA
advapi32
RegCreateKeyA
RegSetValueExA
RegOpenKeyA
RegCloseKey
RegOpenKeyExA
RegEnumKeyA
RegDeleteKeyA
RegQueryValueExA
ole32
StringFromCLSID
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
ReaRoute_Init
Sections
.text Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text1 Size: 4KB - Virtual size: 204B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 4KB - Virtual size: 864B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 908B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ