6565e3e8fd501857ee6f4951a85bee9a8990352232c0823b603317ffd180d43c

Sharing

Copy URL Twitter E-mail

General

Target

6565e3e8fd501857ee6f4951a85bee9a8990352232c0823b603317ffd180d43c
Size

13KB
MD5

35d25c9c08761125f32c9b2dbedf8443
SHA1

8ad27458b42265a88d58f25bf08a230dea053e54
SHA256

6565e3e8fd501857ee6f4951a85bee9a8990352232c0823b603317ffd180d43c
SHA512

883f229795ecbe02022a2843856a66ffe4d88f03b5c327cf2308b882528243270419d474b54febfbb8c0ceb65d6cb3f95c23bb4f931ed5796322b5e3e1af8b05
SSDEEP

384:vk6WRkstgu5xBwiL1WHAqLEeDpyHxvu9:MnLSVDRDGvi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6565e3e8fd501857ee6f4951a85bee9a8990352232c0823b603317ffd180d43c

Files

6565e3e8fd501857ee6f4951a85bee9a8990352232c0823b603317ffd180d43c
.dll windows:5 windows x86 arch:x86

072ee7f56f58f556a1f05098b4beef6c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\ImageMagick\VisualMagick\bin\IM_MOD_RL_mpeg_.pdb

Imports

kernel32

MultiByteToWideChar
GetShortPathNameW
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer

core_rl_magickcore_

OpenBlob
GetPathComponent
GetPathAttributes
CoalesceImages
FormatLocaleString
CopyMagickString
AcquireImage
CloneImage
DestroyImage
CloneImageInfo
DestroyImageInfo
BlobToFile
FileToBlob
InvokeDelegate
CloseBlob
ReadImage
WriteImage
LogMagickEvent
RegisterMagickInfo
UnregisterMagickInfo
AcquireMagickInfo
DestroyImageList
GetNextImageInList
AcquireQuantumMemory
RelinquishMagickMemory
AcquireUniqueFileResource
RelinquishUniqueFileResource

msvcr120

_malloc_crt
_initterm
_initterm_e
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
__clean_type_info_names_internal
_except_handler4_common
free
_amsg_exit
__CppXcptFilter
_except1
_fstat64
_wopen
_write
_read
_close

Exports

Exports

RegisterMPEGImage
UnregisterMPEGImage

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 860B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 916B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

072ee7f56f58f556a1f05098b4beef6c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

core_rl_magickcore_

msvcr120

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 860B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 1024B - Virtual size: 916B

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 860B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 1024B - Virtual size: 916B