eea083bfcaea64a04e52eb1d15e07132

Sharing

Copy URL

Twitter E-mail

General

Target

eea083bfcaea64a04e52eb1d15e07132
Size

71KB
MD5

0d6d19eeb517cfa45c285a28860fc941
SHA1

a87b880ccc95dc78de924c05c0761b68e2d708a3
SHA256

613e6a8a49a61f157a8e064b7fbc7bd5d59909d47e31f6c18cd5c5659808ee89
SHA512

508df8479fbb617c6d18915f6de14d19d2389c2b868682c0cce3b0b56aac9f1ad7dfbbc3cd289a2ccc8ab2ae23e3cf05dc32f9f7c9ba6eb5e02e5f5c8814ce8f
SSDEEP

1536:35q3PS6wt961ASYtbSJ1H81NjrqYSHvdaMJjAxWTV1/3:syaYtOm1NfmdaCMUV1P

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eea083bfcaea64a04e52eb1d15e07132

Files

eea083bfcaea64a04e52eb1d15e07132
.dll regsvr32 windows:4 windows x64 arch:x64

9e89b06661c393195797fb70ceba29aa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

advapi32

GetUserNameW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW

kernel32

CloseHandle
CopyFileW
CreateFileW
CreateMutexW
CreatePipe
CreateProcessW
CreateThread
DeleteCriticalSection
DeleteFileW
EnterCriticalSection
ExpandEnvironmentStringsW
FindClose
FindFirstFileW
FindNextFileW
GetCommandLineW
GetComputerNameExW
GetComputerNameW
GetCurrentDirectoryW
GetLastError
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetSystemInfo
GetTempPathW
GetTickCount
GetVolumeInformationW
GlobalMemoryStatusEx
HeapAlloc
HeapFree
HeapReAlloc
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryW
MultiByteToWideChar
PeekNamedPipe
ReadFile
SetCurrentDirectoryW
SetFilePointer
SetHandleInformation
SetLastError
Sleep
TerminateProcess
TlsGetValue
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteFile

msvcrt

___lc_codepage_func
___mb_cur_max_func
__iob_func
_amsg_exit
_errno
_initterm
_lock
_unlock
_wcsnicmp
abort
calloc
fputwc
free
fwprintf
fwrite
localeconv
malloc
memcpy
memset
realloc
strcat
strcpy
strerror
strlen
strncmp
vfprintf
wcscat
wcscmp
wcscpy
wcslen

shell32

CommandLineToArgvW
SHGetFolderPathW

ws2_32

WSACleanup
WSAStartup
gethostbyname
gethostname
inet_ntoa

Exports

Exports

DllGetClassObject
DllRegisterServer
DllRegisterServerEx
DllUnregisterServer
Start

Sections

.text
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 544B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9e89b06661c393195797fb70ceba29aa

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

shell32

ws2_32

Exports

Exports

Sections

.text Size: 54KB - Virtual size: 54KB

.data Size: 1024B - Virtual size: 544B

.rdata Size: 5KB - Virtual size: 4KB

.pdata Size: 2KB - Virtual size: 1KB

.xdata Size: 2KB - Virtual size: 1KB

.bss Size: - Virtual size: 3KB

.edata Size: 512B - Virtual size: 184B

.idata Size: 3KB - Virtual size: 3KB

.CRT Size: 512B - Virtual size: 88B

.tls Size: 512B - Virtual size: 16B

.reloc Size: 512B - Virtual size: 100B

.text
Size: 54KB - Virtual size: 54KB

.data
Size: 1024B - Virtual size: 544B

.rdata
Size: 5KB - Virtual size: 4KB

.pdata
Size: 2KB - Virtual size: 1KB

.xdata
Size: 2KB - Virtual size: 1KB

.bss
Size: - Virtual size: 3KB

.edata
Size: 512B - Virtual size: 184B

.idata
Size: 3KB - Virtual size: 3KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 16B

.reloc
Size: 512B - Virtual size: 100B