b9764b92f9eaa4f1c367406691e6a8699aacda167baf68cee3affbb30b7ea537

Sharing

Copy URL Twitter E-mail

General

Target

b9764b92f9eaa4f1c367406691e6a8699aacda167baf68cee3affbb30b7ea537
Size

576KB
MD5

a35a42d502e1e1e9cc43896a903cf4d9
SHA1

c2cb293139626eec26203deebd8f8a251ac3e6c1
SHA256

b9764b92f9eaa4f1c367406691e6a8699aacda167baf68cee3affbb30b7ea537
SHA512

9980119259c5f0fe6ba31bf880f5f52ad6c81a366f292ed2dceebe8408d49c2ba19b932da155706a4ac6b3544e733f6e28e110f08b9aa935dc2e98cda4017a19
SSDEEP

12288:hl1qpuQFfXkQvDVyEeTk+Zkf5RLdCTOyeIx:TwuQpXk+8kCKZwx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b9764b92f9eaa4f1c367406691e6a8699aacda167baf68cee3affbb30b7ea537

Files

b9764b92f9eaa4f1c367406691e6a8699aacda167baf68cee3affbb30b7ea537
.dll regsvr32 windows:6 windows x86 arch:x86

ede47f715d14052027725b8aebadbe1b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

P:\Target\x86\ship\mscdm\x-none\mscdm.pdb

Imports

msvcr100

?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
__clean_type_info_names_internal
_crt_debugger_hook
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
vswprintf_s
calloc
_vsnwprintf_s
_wtol
??_V@YAXPAX@Z
??2@YAPAXI@Z
memcpy_s
wcscat_s
wcscpy_s
wcsncpy_s
wcsstr
free
malloc
_recalloc
??_U@YAPAXI@Z
__CxxFrameHandler3
memset
iswspace
memcpy
realloc
memcmp
memmove
wcschr
wcscspn
??3@YAXPAX@Z

kernel32

GetCurrentProcessId
LocalAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
DecodePointer
EncodePointer
HeapFree
HeapAlloc
WerRegisterMemoryBlock
VirtualProtect
GetTickCount
GetSystemTimeAsFileTime
LoadLibraryA
HeapSetInformation
GetProcessHeap
QueryPerformanceCounter
GetModuleFileNameA
RaiseException
GetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
DisableThreadLibraryCalls
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadLibraryExW
LoadResource
SizeofResource
lstrcmpiW
lstrlenW
FindResourceW
MultiByteToWideChar
WaitForSingleObject
GetCurrentThreadId
GetSystemDefaultLCID
SetEvent
WaitForMultipleObjects
Sleep
CompareStringW
WideCharToMultiByte
GetUserDefaultLCID
InitializeCriticalSection

ole32

CoCreateGuid
CoTaskMemFree
CoTaskMemRealloc
StringFromCLSID
CoGetMalloc
CoCreateInstance
CoTaskMemAlloc
StringFromGUID2

oleaut32

VariantClear
VariantCopy
VariantInit
VarCmp
SysAllocStringLen
SysStringByteLen
SysAllocStringByteLen
VariantChangeType
VarSu
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayGetElement
VarBstrCmp
SetErrorInfo
GetErrorInfo
CreateErrorInfo
VariantChangeTypeEx
UnRegisterTypeLi
RegisterTypeLi
LoadTypeLi
VarUI4FromStr
SysStringLen
SysAllocString
SysFreeString
VarAdd

advapi32

RegOpenKeyExA
RegCreateKeyExW
RegDeleteKeyW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegSetValueExA
RegQueryValueExW
RegQueryValueExA
RegCloseKey
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW

mfc100u

ord3413
ord2068
ord2062
ord2064

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 281KB - Virtual size: 280KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 279KB - Virtual size: 280KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ede47f715d14052027725b8aebadbe1b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcr100

kernel32

ole32

oleaut32

advapi32

mfc100u

Exports

Exports

Sections

.text Size: 281KB - Virtual size: 280KB

.data Size: 10KB - Virtual size: 11KB

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 279KB - Virtual size: 280KB

.text
Size: 281KB - Virtual size: 280KB

.data
Size: 10KB - Virtual size: 11KB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 279KB - Virtual size: 280KB