c249fca04f5f362bb43731b5ae9e7e85a76f6c1472e1c41c40496ab05b513230

General

Target

c249fca04f5f362bb43731b5ae9e7e85a76f6c1472e1c41c40496ab05b513230
Size

9KB
MD5

4ab0bf4e35f1deb1c7454e7dada42ff3
SHA1

c4f1177f68676b770934b142f9c3e2c4eff7f164
SHA256

c249fca04f5f362bb43731b5ae9e7e85a76f6c1472e1c41c40496ab05b513230
SHA512

ccdde8d7360c164c0f3669247479f635f039a23d489d4a4607f87713dc06c4ec46268bc84f694b7f2871e8b33f265c97ac308443a113755a238cd5cab4211735
SSDEEP

96:i2KcOywP4aq8z4IyUvpl3hq+QMBCuO3XExuptzGC7tf:TNo4XE4dUB7q+z4B3XoupJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c249fca04f5f362bb43731b5ae9e7e85a76f6c1472e1c41c40496ab05b513230

Files

c249fca04f5f362bb43731b5ae9e7e85a76f6c1472e1c41c40496ab05b513230
.dll windows:5 windows x64 arch:x64

c4def36f4783f35661a5fcc366341ee5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\Administrator\Documents\Visual Studio 2008\Projects\dll\x64\Release\dll.pdb

Imports

kernel32

CreateFileW
WriteFile
CloseHandle
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
Sleep
GetSystemTimeAsFileTime

msvcr90

_unlock
__dllonexit
_lock
_onexit
__crt_debugger_hook
__CppXcptFilter
__C_specific_handler
_amsg_exit
_decode_pointer
_encoded_null
free
_initterm_e
_initterm
_malloc_crt
_encode_pointer
wcsstr
_vswprintf
__clean_type_info_names_internal
memset

Exports

Exports

InitializeChangeNotify
PasswordChangeNotify
PasswordFilter

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 204B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c4def36f4783f35661a5fcc366341ee5

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

msvcr90

Exports

Exports

Sections

.text Size: 3KB - Virtual size: 2KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 3KB

.pdata Size: 512B - Virtual size: 204B

.rsrc Size: 1024B - Virtual size: 688B

.reloc Size: 512B - Virtual size: 36B

.text
Size: 3KB - Virtual size: 2KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 3KB

.pdata
Size: 512B - Virtual size: 204B

.rsrc
Size: 1024B - Virtual size: 688B

.reloc
Size: 512B - Virtual size: 36B