3f4222aaabf988893c842d955b48b73980cced07110c4f6e0504d50bf1c14eec

Sharing

Copy URL Twitter E-mail

General

Target

3f4222aaabf988893c842d955b48b73980cced07110c4f6e0504d50bf1c14eec
Size

52KB
MD5

18c6f67c4c8a13b145789adb45ce31d5
SHA1

30e3141c1f10aa21704cc6b6e464d6b7b2f6cf87
SHA256

3f4222aaabf988893c842d955b48b73980cced07110c4f6e0504d50bf1c14eec
SHA512

4f6183d50846339b467563b0cc0b1b90ef2820440fdf548cf1d0cf8a19f1c82f53a25705c9349c807abd4172f9fb1325e259bc190a0ad499dfeb239cebcfeb5b
SSDEEP

1536:nfsfnm0KQcTxMgIekNY/tCVYbaEYw1UOZtv:fsfKQOygxcYiLw1UOZtv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3f4222aaabf988893c842d955b48b73980cced07110c4f6e0504d50bf1c14eec

Files

3f4222aaabf988893c842d955b48b73980cced07110c4f6e0504d50bf1c14eec
.dll windows:5 windows x86 arch:x86

05993037d7287201a8396a5bf801f817

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\VSWorkSpace_Tube\V15\LibraryTubeBeta-AdobeTech\ArcTransition\Release\ArcTransition.pdb

Imports

mfc100

ord266
ord2050
ord408
ord1294
ord1948
ord1929
ord1296

msvcr100

_initterm_e
_amsg_exit
__CppXcptFilter
_crt_debugger_hook
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_initterm
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_CItan
_encoded_null
free
_malloc_crt
?terminate@@YAXXZ
_copysign
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
_purecall
_CIatan
_CIsqrt
_CxxThrowException
_CIacos
__CxxFrameHandler3
_CIsin
_CIatan2
_CIcos
_onexit

kernel32

SetUnhandledExceptionFilter
DecodePointer
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
EncodePointer
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange

msvcp100

?_Xlength_error@std@@YAXPBD@Z

Exports

Exports

??0CArcTransition@ArcTransition@@QAE@ABV01@@Z
??0CArcTransition@ArcTransition@@QAE@XZ
??1CArcTransition@ArcTransition@@UAE@XZ
??4CArcTransition@ArcTransition@@QAEAAV01@ABV01@@Z
??_7CArcTransition@ArcTransition@@6B@
?DoArcTransition@CArcTransition@ArcTransition@@UAE_NPBVCPath@2@PAV32@@Z
?Initialize@CArcTransition@ArcTransition@@UAE_NPBUArcTransitionInfo@2@@Z
DoArcTransition

Sections

.text
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

05993037d7287201a8396a5bf801f817

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mfc100

msvcr100

kernel32

msvcp100

Exports

Exports

Sections

.text Size: 43KB - Virtual size: 42KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 43KB - Virtual size: 42KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB