65c7c98275050652a921da562d4c5283b11f3a9e8f95a4ab2abcad789851b436

Sharing

Copy URL Twitter E-mail

General

Target

65c7c98275050652a921da562d4c5283b11f3a9e8f95a4ab2abcad789851b436
Size

1.0MB
MD5

fa17743b7ea6133a14083271478f1535
SHA1

b78154ab07704a14c84cdb79aee602185808b3d6
SHA256

65c7c98275050652a921da562d4c5283b11f3a9e8f95a4ab2abcad789851b436
SHA512

45eeb2dfdbbac1d03a2f45878f2a61732d9e29dc5ca74fd9987d38e2247ac8b7441879a8e32a5bf02c6161bb426a115e883969fe5fe281c856f1a192ef7b034a
SSDEEP

12288:sxqXLMb0e/bLejifq4IatuNZ2gszZadM000:wqX07rqjatuznIZoM000

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
65c7c98275050652a921da562d4c5283b11f3a9e8f95a4ab2abcad789851b436

Files

65c7c98275050652a921da562d4c5283b11f3a9e8f95a4ab2abcad789851b436
.dll regsvr32 windows:4 windows x64 arch:x64

615b5b7890a65e5764756f1eb1649d77

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

advapi32

RegCloseKey
RegEnumKeyExW
RegOpenKeyW

kernel32

CloseHandle
CreateEventW
DelayLoadFailureHook
DeleteCriticalSection
DisableThreadLibraryCalls
EnterCriticalSection
EnumResourceNamesW
FindResourceW
GetEnvironmentVariableW
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
GetTickCount
HeapAlloc
HeapFree
HeapReAlloc
InitializeCriticalSection
IsBadStringPtrW
LeaveCriticalSection
LoadLibraryW
LoadResource
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ResolveDelayLoadedAPI
SizeofResource
lstrcmpW

mfplat

MFCalculateImageSize
MFCancelWorkItem
MFCreateAlignedMemoryBuffer
MFCreateAsyncResult
MFCreateAttributes
MFCreateCollection
MFCreateEventQueue
MFCreateFile
MFCreateMFByteStreamOnStream
MFCreateMediaEvent
MFCreateMediaType
MFCreateSample
MFCreateSourceResolver
MFCreateSystemTimeSource
MFGetSystemTime
MFInitMediaTypeFromWaveFormatEx
MFInvokeCallback
MFPutWaitingWorkItem
MFPutWorkItem
MFPutWorkItemEx
MFScheduleWorkItemEx
MFTEnumEx
MFTRegisterLocalByCLSID

ntdll

_vsnprintf

ole32

CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
PropVariantClear
PropVariantCopy

ucrtbase

__acrt_iob_func
__stdio_common_vsprintf
_assert
_strdup
_wcsdup
_wcsnicmp
calloc
free
fwrite
getenv
malloc
memcmp
memcpy
memmove
memset
qsort
realloc
strchr
strcmp
strcspn
strlen
wcschr
wcscmp

Exports

Exports

AppendPropVariant
ConvertPropVariant
CopyPropertyStore
CreateNamedPropertyStore
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
ExtractPropVariant
MFCreate3GPMediaSink
MFCreateAC3MediaSink
MFCreateADTSMediaSink
MFCreateASFByteStreamPlugin
MFCreateASFContentInfo
MFCreateASFIndexer
MFCreateASFIndexerByteStream
MFCreateASFMediaSink
MFCreateASFMediaSinkActivate
MFCreateASFMultiplexer
MFCreateASFProfile
MFCreateASFProfileFromPresentationDescriptor
MFCreateASFSplitter
MFCreateASFStreamSelector
MFCreateASFStreamingMediaSink
MFCreateASFStreamingMediaSinkActivate
MFCreateAggregateSource
MFCreateAppSourceProxy
MFCreateAudioRenderer
MFCreateAudioRendererActivate
MFCreateByteCacheFile
MFCreateCacheManager
MFCreateCredentialCache
MFCreateDeviceSource
MFCreateDeviceSourceActivate
MFCreateDrmNetNDSchemePlugin
MFCreateFMPEG4MediaSink
MFCreateFileBlockMap
MFCreateFileSchemePlugin
MFCreateHttpSchemePlugin
MFCreateLPCMByteStreamPlugin
MFCreateMP3ByteStreamPlugin
MFCreateMP3MediaSink
MFCreateMPEG4MediaSink
MFCreateMediaProcessor
MFCreateMediaSession
MFCreateNSCByteStreamPlugin
MFCreateNetSchemePlugin
MFCreatePMPHost
MFCreatePMPMediaSession
MFCreatePMPServer
MFCreatePresentationClock
MFCreatePresentationDescriptorFromASFProfile
MFCreateProxyLocator
MFCreateRemoteDesktopPlugin
MFCreateSAMIByteStreamPlugin
MFCreateSampleCopierMFT
MFCreateSampleGrabberSinkActivate
MFCreateSecureHttpSchemePlugin
MFCreateSequencerSegmentOffset
MFCreateSequencerSource
MFCreateSequencerSourceRemoteStream
MFCreateSimpleTypeHandler
MFCreateSourceResolver
MFCreateStandardQualityManager
MFCreateTopoLoader
MFCreateTopology
MFCreateTopologyNode
MFCreateTranscodeProfile
MFCreateTranscodeSinkActivate
MFCreateTranscodeTopology
MFCreateUrlmonSchemePlugin
MFCreateVideoRenderer
MFCreateVideoRendererActivate
MFCreateWMAEncoderActivate
MFCreateWMVEncoderActivate
MFEnumDeviceSources
MFGetMultipleServiceProviders
MFGetService
MFGetSupportedMimeTypes
MFGetSupportedSchemes
MFGetTopoNodeCurrentType
MFReadSequencerSegmentOffset
MFRequireProtectedEnvironment
MFShutdownObject
MFTranscodeGetAudioOutputAvailableTypes
MergePropertyStore

Sections

.text
Size: 192KB - Virtual size: 191KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 112KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

615b5b7890a65e5764756f1eb1649d77

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

mfplat

ntdll

ole32

ucrtbase

Exports

Exports

Sections

.text Size: 192KB - Virtual size: 191KB

.data Size: 4KB - Virtual size: 944B

.rodata Size: 4KB - Virtual size: 1KB

.rdata Size: 112KB - Virtual size: 110KB

/4 Size: 4KB - Virtual size: 1KB

.pdata Size: 12KB - Virtual size: 10KB

.xdata Size: 16KB - Virtual size: 12KB

.edata Size: 4KB - Virtual size: 3KB

.idata Size: 4KB - Virtual size: 3KB

.rsrc Size: 4KB - Virtual size: 1016B

.reloc Size: 4KB - Virtual size: 1KB

.text
Size: 192KB - Virtual size: 191KB

.data
Size: 4KB - Virtual size: 944B

.rodata
Size: 4KB - Virtual size: 1KB

.rdata
Size: 112KB - Virtual size: 110KB

/4
Size: 4KB - Virtual size: 1KB

.pdata
Size: 12KB - Virtual size: 10KB

.xdata
Size: 16KB - Virtual size: 12KB

.edata
Size: 4KB - Virtual size: 3KB

.idata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 4KB - Virtual size: 1016B

.reloc
Size: 4KB - Virtual size: 1KB