44e658b6341426ec19c715ae68ec3a9ea148fbae823eb167acc786dec8da08db

Sharing

Copy URL Twitter E-mail

General

Target

44e658b6341426ec19c715ae68ec3a9ea148fbae823eb167acc786dec8da08db
Size

572KB
MD5

e45d4a03daed25dab7b2d028e8dd2827
SHA1

1492678a5e51c415427df949c392ad81785ee4ea
SHA256

44e658b6341426ec19c715ae68ec3a9ea148fbae823eb167acc786dec8da08db
SHA512

648211fe4f3628112ed012fb59363e77c09345e10f276f08b090630f371e7710c611239fb6f8e94a186f56b708647013c2eff2bd57d0a1cd30602efe8e75a2d5
SSDEEP

12288:IXItqgyK+6K9EN0k1xErOBBm4HRUl64aZgkZFt4Ya3:J5yNz9E3ZBNxUfaqkh0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
44e658b6341426ec19c715ae68ec3a9ea148fbae823eb167acc786dec8da08db

Files

44e658b6341426ec19c715ae68ec3a9ea148fbae823eb167acc786dec8da08db
.dll regsvr32 windows:6 windows x86 arch:x86

ede47f715d14052027725b8aebadbe1b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

P:\Target\x86\ship\mscdm\x-none\mscdm.pdb

Imports

msvcr100

?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
__clean_type_info_names_internal
_crt_debugger_hook
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
vswprintf_s
calloc
_vsnwprintf_s
_wtol
??_V@YAXPAX@Z
??2@YAPAXI@Z
memcpy_s
wcscat_s
wcscpy_s
wcsncpy_s
wcsstr
free
malloc
_recalloc
??_U@YAPAXI@Z
__CxxFrameHandler3
memset
iswspace
memcpy
realloc
memcmp
memmove
wcschr
wcscspn
??3@YAXPAX@Z

kernel32

GetCurrentProcessId
LocalAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
DecodePointer
EncodePointer
HeapFree
HeapAlloc
WerRegisterMemoryBlock
VirtualProtect
GetTickCount
GetSystemTimeAsFileTime
LoadLibraryA
HeapSetInformation
GetProcessHeap
QueryPerformanceCounter
GetModuleFileNameA
RaiseException
GetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
DisableThreadLibraryCalls
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadLibraryExW
LoadResource
SizeofResource
lstrcmpiW
lstrlenW
FindResourceW
MultiByteToWideChar
WaitForSingleObject
GetCurrentThreadId
GetSystemDefaultLCID
SetEvent
WaitForMultipleObjects
Sleep
CompareStringW
WideCharToMultiByte
GetUserDefaultLCID
InitializeCriticalSection

ole32

CoCreateGuid
CoTaskMemFree
CoTaskMemRealloc
StringFromCLSID
CoGetMalloc
CoCreateInstance
CoTaskMemAlloc
StringFromGUID2

oleaut32

VariantClear
VariantCopy
VariantInit
VarCmp
SysAllocStringLen
SysStringByteLen
SysAllocStringByteLen
VariantChangeType
VarSu
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayGetElement
VarBstrCmp
SetErrorInfo
GetErrorInfo
CreateErrorInfo
VariantChangeTypeEx
UnRegisterTypeLi
RegisterTypeLi
LoadTypeLi
VarUI4FromStr
SysStringLen
SysAllocString
SysFreeString
VarAdd

advapi32

RegOpenKeyExA
RegCreateKeyExW
RegDeleteKeyW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegSetValueExA
RegQueryValueExW
RegQueryValueExA
RegCloseKey
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW

mfc100u

ord3413
ord2068
ord2062
ord2064

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 281KB - Virtual size: 280KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 275KB - Virtual size: 276KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ede47f715d14052027725b8aebadbe1b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcr100

kernel32

ole32

oleaut32

advapi32

mfc100u

Exports

Exports

Sections

.text Size: 281KB - Virtual size: 280KB

.data Size: 10KB - Virtual size: 11KB

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 275KB - Virtual size: 276KB

.text
Size: 281KB - Virtual size: 280KB

.data
Size: 10KB - Virtual size: 11KB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 275KB - Virtual size: 276KB