eb7978cc18c863bb6b484bca17d69748769ade8a9d8cf6af475af043ab37df0b

Sharing

Copy URL Twitter E-mail

General

Target

eb7978cc18c863bb6b484bca17d69748769ade8a9d8cf6af475af043ab37df0b
Size

165KB
MD5

c29a9f2f686bdbfbf35bd5744f7230fc
SHA1

95423391eb68f4da8966cc6c647657a26c510073
SHA256

eb7978cc18c863bb6b484bca17d69748769ade8a9d8cf6af475af043ab37df0b
SHA512

037c42c1aecc5a7e83ec49aa35552a06e33da65f3f26443de095d31aab13acbd0e9a6d7a94e4bdbd4e9a433bb7e68c92ceefc9edf1905e77d70dc5bca82a0a6a
SSDEEP

3072:kTH85gsX43SqmlTEGYG0gRL2l/XJwzV5gyDkDK/5gp4idvOmJQb8de1Q03G68dez:J5gDShIxTgRaF5wzPA+5g4idvOmA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eb7978cc18c863bb6b484bca17d69748769ade8a9d8cf6af475af043ab37df0b

Files

eb7978cc18c863bb6b484bca17d69748769ade8a9d8cf6af475af043ab37df0b
.dll windows:5 windows x64 arch:x64

5c3296abdcb17a06e7af40e34e6b868c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

FreeLibrary
LoadLibraryW
GetFileAttributesW
GetProcAddress
DecodePointer
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
EncodePointer
OutputDebugStringA
WideCharToMultiByte
MultiByteToWideChar
FoldStringW
QueryPerformanceCounter

user32

CharUpperW
CharLowerW
CharLowerA
MessageBoxW
CharUpperA

shell32

SHGetFolderPathW

msvcp120

?_Syserror_map@std@@YAPEBDH@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Winerror_map@std@@YAPEBDH@Z

msvcr120

??_V@YAXPEAX@Z
_purecall
??3@YAXPEAX@Z
??2@YAPEAX_K@Z
free
malloc
realloc
iswalpha
iswdigit
iswspace
iswalnum
_vsnwprintf
_vswprintf
wcsrchr
_stricmp
strncmp
_strnicmp
memset
sscanf
_vsnprintf
sprintf
isalpha
isdigit
isspace
strlen
toupper
__CxxFrameHandler3
strncpy
fclose
fopen
fread
fseek
ftell
fwrite
memcmp
_CxxThrowException
?terminate@@YAXXZ
__C_specific_handler
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
__CppXcptFilter
_amsg_exit
_malloc_crt
_initterm
_initterm_e
__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
memmove
wcscat
_itoa
memcpy
isalnum
_wcsicmp
strrchr
_wcsnicmp

ole32

CoCreateGuid

Exports

Exports

ACFCanUnloadNow
ACFGetClassFactory
ACFGetSDKVersion
ACFRegisterComponent
ACFRegisterPlugin
ACFShutdown
ACFStartup
ExitDll
GetPluginFactory
InitDll
MAIN
VSTPluginMain
main

Sections

.text
Size: 102KB - Virtual size: 102KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5c3296abdcb17a06e7af40e34e6b868c

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

msvcp120

msvcr120

ole32

Exports

Exports

Sections

.text Size: 102KB - Virtual size: 102KB

.rdata Size: 36KB - Virtual size: 35KB

.data Size: 1024B - Virtual size: 1KB

.pdata Size: 7KB - Virtual size: 7KB

.reloc Size: 1024B - Virtual size: 832B

.text
Size: 102KB - Virtual size: 102KB

.rdata
Size: 36KB - Virtual size: 35KB

.data
Size: 1024B - Virtual size: 1KB

.pdata
Size: 7KB - Virtual size: 7KB

.reloc
Size: 1024B - Virtual size: 832B