f2c9ee6f99386e36f7425e007cdaa4c9af05e62e94cf904d2d647e14c1c64cd8

Sharing

Copy URL Twitter E-mail

General

Target

f2c9ee6f99386e36f7425e007cdaa4c9af05e62e94cf904d2d647e14c1c64cd8
Size

164KB
MD5

2a30c9fed11a3381e95ed2ca925ad616
SHA1

fd3f67d6a5e98636a627fe63471a52f39c0db8dd
SHA256

f2c9ee6f99386e36f7425e007cdaa4c9af05e62e94cf904d2d647e14c1c64cd8
SHA512

5398d72e1c55698527b8651fe3672a07c6081ff58540850d75ace8444f80ae4c7b278a6bcef8e2668aeca6b097e5bdbe56ccd2caed6bdd2340aedab3f7d2424c
SSDEEP

3072:Dg+yhF1R7s1n7lYwGOwk1zEkDORuY1/SIN:Dg+yjs1n7lYwGOt7yRuY/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f2c9ee6f99386e36f7425e007cdaa4c9af05e62e94cf904d2d647e14c1c64cd8

Files

f2c9ee6f99386e36f7425e007cdaa4c9af05e62e94cf904d2d647e14c1c64cd8
.dll regsvr32 windows:4 windows x86 arch:x86

0b8851fcbd68ad9ad951f25211c65c00

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcatA
OpenFile
EnterCriticalSection
GetModuleFileNameA
lstrlenA
lstrcpyA
LeaveCriticalSection
DeleteCriticalSection
LoadLibraryA
GetProcAddress
InitializeCriticalSection
FreeLibrary
GetWindowsDirectoryA
lstrcmpiA

advapi32

RegEnumValueA
RegCreateKeyExA
RegSetValueExA
RegDeleteValueA
RegOpenKeyExA
RegQueryInfoKeyA
RegCloseKey
RegDeleteKeyA

msvcrt

memset
_CxxThrowException
__CxxFrameHandler
strlen
strcpy
??2@YAPAXI@Z
_stricmp
strcat
strcmp
sprintf
_splitpath
realloc
_except_handler3
free
malloc
??3@YAXPAX@Z
fprintf
clock
time
_ftol
strtok
atol
atoi
_iob
qsort
_purecall
exit
memmove
??1type_info@@UAE@XZ
strncmp
strchr
strncpy
_strdup

msvcirt

?write@ostream@@QAEAAV1@PBDH@Z
?read@istream@@QAEAAV1@PADH@Z

Exports

Exports

DllRegisterServer
DllUnregisterServer
TtsCTConvEscCmdToEsc
TtsCTCreateInstance
TtsCTDeleteInstance
TtsCTGetAboutText
TtsCTGetCapacity
TtsCTGetCode
TtsCTGetEngineInfo
TtsCTGetIPASymbols
TtsCTGetLipSync
TtsCTGetLoadedPP
TtsCTGetMode
TtsCTGetMrkNo
TtsCTGetMrkRecords
TtsCTGetPcmData
TtsCTGetTtsUnit
TtsCTGetVoiceMode
TtsCTIPA2LHP
TtsCTLH2LHP
TtsCTLHP2IPA
TtsCTLingProcess
TtsCTLpGenG2PStr
TtsCTPassInfo
TtsCTProsodyHndl
TtsCTRemoveAllDctEntries
TtsCTSelectPP
TtsCTSelectVoiceFont
TtsCTSetDefParm
TtsCTSetFreq
TtsCTSetMode
TtsCTSetMrkMode
TtsCTSetSynthRange
TtsCTSetVoiceMode
TtsCTSpeakPhonetic
TtsCTTsCheckWord
TtsCTTtsCodeToUnicode
TtsCTUnInit
TtsCTUnicodeToTtsCode

Sections

.text
Size: 104KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0b8851fcbd68ad9ad951f25211c65c00

Headers

File Characteristics

Imports

kernel32

advapi32

msvcrt

msvcirt

Exports

Exports

Sections

.text Size: 104KB - Virtual size: 100KB

.rdata Size: 20KB - Virtual size: 16KB

.data Size: 16KB - Virtual size: 31KB

.rsrc Size: 12KB - Virtual size: 10KB

.reloc Size: 8KB - Virtual size: 5KB

.text
Size: 104KB - Virtual size: 100KB

.rdata
Size: 20KB - Virtual size: 16KB

.data
Size: 16KB - Virtual size: 31KB

.rsrc
Size: 12KB - Virtual size: 10KB

.reloc
Size: 8KB - Virtual size: 5KB