d55ac01ab7c7319781c1973272ce139e19e4b385b21bfabd929c85b8f84bf99f

Sharing

Copy URL Twitter E-mail

General

Target

d55ac01ab7c7319781c1973272ce139e19e4b385b21bfabd929c85b8f84bf99f
Size

222KB
MD5

ce3aa48050c1024786c61d4204364be3
SHA1

952fa132e9a12f45b3fffd6a22a7e49f951def42
SHA256

d55ac01ab7c7319781c1973272ce139e19e4b385b21bfabd929c85b8f84bf99f
SHA512

8a9a5d34bbcd8615c0f85c3f7d52d42fdbdbb438288887baed23df56c6277f19d7dccbbc396060a883d3cde3d251e137d1f750ff7229b285322eb121e56022e3
SSDEEP

3072:rQlg3OFxOHTQIqCVuMfbz5iZ4cJvkL32P7NA:kZvSVuMDsZ4Kv832i

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d55ac01ab7c7319781c1973272ce139e19e4b385b21bfabd929c85b8f84bf99f

Files

d55ac01ab7c7319781c1973272ce139e19e4b385b21bfabd929c85b8f84bf99f
.dll regsvr32 windows:4 windows x86 arch:x86

ce422fa5711aa97d8f077d500dc37484

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

DisableThreadLibraryCalls
EnumResourceNamesW
FindResourceW
GetEnvironmentVariableW
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
GetTickCount
HeapAlloc
HeapFree
HeapReAlloc
IsBadStringPtrA
IsBadStringPtrW
LoadLibraryW
LoadResource
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
SizeofResource

ntdll

_vsnprintf

ole32

CoCreateInstance
CoTaskMemFree

oleaut32

SysAllocString
SysAllocStringLen
SysFreeString
VariantInit
VariantClear
VariantCopy
VariantChangeType
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayGetElement
SafeArrayPutElement
LoadRegTypeLib
SafeArrayCreateVector

ucrtbase

__acrt_iob_func
__stdio_common_vsprintf
_strdup
_wcsdup
_wcsicmp
calloc
free
fwrite
getenv
malloc
memcmp
memcpy
memmove
memset
realloc
strchr
strcmp
strcpy
strcspn
strlen
wcscmp
wcsstr

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 264B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 4KB - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 260B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 60KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ce422fa5711aa97d8f077d500dc37484

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ntdll

ole32

oleaut32

ucrtbase

Exports

Exports

Sections

.text Size: 72KB - Virtual size: 71KB

.data Size: 4KB - Virtual size: 264B

.rodata Size: 4KB - Virtual size: 24B

.rdata Size: 28KB - Virtual size: 25KB

/4 Size: 20KB - Virtual size: 17KB

.bss Size: - Virtual size: 260B

.edata Size: 16KB - Virtual size: 12KB

.idata Size: 4KB - Virtual size: 1KB

.rsrc Size: 60KB - Virtual size: 57KB

.reloc Size: 8KB - Virtual size: 6KB

.text
Size: 72KB - Virtual size: 71KB

.data
Size: 4KB - Virtual size: 264B

.rodata
Size: 4KB - Virtual size: 24B

.rdata
Size: 28KB - Virtual size: 25KB

/4
Size: 20KB - Virtual size: 17KB

.bss
Size: - Virtual size: 260B

.edata
Size: 16KB - Virtual size: 12KB

.idata
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 60KB - Virtual size: 57KB

.reloc
Size: 8KB - Virtual size: 6KB