4995e7a886349e33439fd16fc2aa09ec1e21e3c89f55d996ee0723a26fed0bdb

Sharing

Copy URL Twitter E-mail

General

Target

4995e7a886349e33439fd16fc2aa09ec1e21e3c89f55d996ee0723a26fed0bdb
Size

146KB
MD5

3d23b829f47cf4c03d5db67746c2794b
SHA1

3bbafc294195524c11f25cd7dcffc3e6c7388279
SHA256

4995e7a886349e33439fd16fc2aa09ec1e21e3c89f55d996ee0723a26fed0bdb
SHA512

2377f70f9aa32bc3ac64cac7eafcca686a4f54f4a248fe6545fe72a3160e6ef7960b64f50fa01051672970cd6194306e8951fe826c359ccc4b106eb2d9287f5c
SSDEEP

1536:lhA/rZTPmnCTzLUY5CDqZxWIr85GwwGgb6w1xTBcQaaWRb:lq/9TPmncLj5CD+w52b6wVaaWRb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4995e7a886349e33439fd16fc2aa09ec1e21e3c89f55d996ee0723a26fed0bdb

Files

4995e7a886349e33439fd16fc2aa09ec1e21e3c89f55d996ee0723a26fed0bdb
.dll windows:6 windows x64 arch:x64

96df6b8bff42cdbee654d04cdd30f8b7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\DevOps\git\repos\affinity\build\bin\x64\libjbig2dec.pdb

Imports

vcruntime140

__std_type_info_destroy_list
__C_specific_handler
memset
memmove
__current_exception
__current_exception_context
memcpy

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__stdio_common_vsprintf
__stdio_common_vfprintf
fflush

api-ms-win-crt-heap-l1-1-0

free
malloc
realloc

api-ms-win-crt-string-l1-1-0

strncpy

api-ms-win-crt-runtime-l1-1-0

terminate
_cexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
_crt_atexit
_crt_at_quick_exit

kernel32

GetSystemTimeAsFileTime
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
RtlCaptureContext
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent

Exports

Exports

jbig2_complete_page
jbig2_ctx_free
jbig2_ctx_new_imp
jbig2_data_in
jbig2_global_ctx_free
jbig2_make_global_ctx
jbig2_page_out
jbig2_release_page

Sections

.text
Size: 93KB - Virtual size: 93KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 373B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 667B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

96df6b8bff42cdbee654d04cdd30f8b7

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

kernel32

Exports

Exports

Sections

.text Size: 93KB - Virtual size: 93KB

.rdata Size: 41KB - Virtual size: 40KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 4KB - Virtual size: 3KB

.idata Size: 3KB - Virtual size: 3KB

.00cfg Size: 512B - Virtual size: 373B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 667B

.text
Size: 93KB - Virtual size: 93KB

.rdata
Size: 41KB - Virtual size: 40KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 4KB - Virtual size: 3KB

.idata
Size: 3KB - Virtual size: 3KB

.00cfg
Size: 512B - Virtual size: 373B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 667B