435aff988f1b1b3dbadd59f8116a4c22a3b297b490f274dedbcb878caf0ee2ba

Sharing

Copy URL Twitter E-mail

General

Target

435aff988f1b1b3dbadd59f8116a4c22a3b297b490f274dedbcb878caf0ee2ba
Size

822KB
MD5

d3842680da5c7c3e81ba6fc158dfcd53
SHA1

195eecae39e61a3b90664cceefc227d5871ddce5
SHA256

435aff988f1b1b3dbadd59f8116a4c22a3b297b490f274dedbcb878caf0ee2ba
SHA512

5a0eb6785d7efa76c6e9aba953fa40e5f5ba268365f2201e831cb086c87e2e46d91c70b5e2c3e4551bfa594fa718d75681a9e0cb27206c356f3b692871a51d62
SSDEEP

6144:dRuphjLdy62fy4pRzYxoD6oTkC5J1lp/Y8vronmnS0DMmzzzvSJ:Du7+r6ogkJXlRnc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
435aff988f1b1b3dbadd59f8116a4c22a3b297b490f274dedbcb878caf0ee2ba

Files

435aff988f1b1b3dbadd59f8116a4c22a3b297b490f274dedbcb878caf0ee2ba
.dll regsvr32 windows:4 windows x86 arch:x86

ba6377c4be8361f9aaf24a3e0d08a75d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

advapi32

ImpersonateAnonymousToken
ImpersonateLoggedOnUser
RegFlushKey

kernel32

CloseHandle
CreateFileA
CreatePipe
CreateProcessA
CreateThread
DeleteCriticalSection
DeleteFileA
EnterCriticalSection
EscapeCommFunction
GetBinaryTypeA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeProcess
GetLastError
GetProcAddress
GetSystemTimeAsFileTime
GetTempFileNameA
GetTempPathA
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
QueryPerformanceCounter
ReadFile
ReplaceFileA
SetCommMask
SetEnvironmentVariableA
SetLastError
SetNamedPipeHandleState
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForSingleObject

msvcrt

_amsg_exit
_initterm
_iob
_lock
_snprintf
_unlock
abort
calloc
free
fwrite
malloc
realloc
strlen
strncmp
vfprintf

Exports

Exports

DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
InitHelperDll
StartW

Sections

.text
Size: 116KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 628KB - Virtual size: 627KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 944B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 200B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ba6377c4be8361f9aaf24a3e0d08a75d

Headers

File Characteristics

Imports

advapi32

kernel32

msvcrt

Exports

Exports

Sections

.text Size: 116KB - Virtual size: 116KB

.data Size: 628KB - Virtual size: 627KB

.rdata Size: 58KB - Virtual size: 57KB

.bss Size: - Virtual size: 944B

.edata Size: 512B - Virtual size: 200B

.idata Size: 2KB - Virtual size: 1KB

.CRT Size: 512B - Virtual size: 44B

.tls Size: 512B - Virtual size: 8B

.reloc Size: 15KB - Virtual size: 14KB

.text
Size: 116KB - Virtual size: 116KB

.data
Size: 628KB - Virtual size: 627KB

.rdata
Size: 58KB - Virtual size: 57KB

.bss
Size: - Virtual size: 944B

.edata
Size: 512B - Virtual size: 200B

.idata
Size: 2KB - Virtual size: 1KB

.CRT
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 8B

.reloc
Size: 15KB - Virtual size: 14KB