b20ec815c2f96f545d59d0686719dac4a0f4809107302478b117f60ccd870805

Sharing

Copy URL Twitter E-mail

General

Target

b20ec815c2f96f545d59d0686719dac4a0f4809107302478b117f60ccd870805
Size

2.9MB
MD5

eae04a472d17081bb03133228c27b87b
SHA1

683689f51c0c147668fcddda1f6a09cf746549c0
SHA256

b20ec815c2f96f545d59d0686719dac4a0f4809107302478b117f60ccd870805
SHA512

7771fb89edb78d1229c7698203fbde4831477fdadeb79eac258477699ea55fa86c1654cd3448f76cc25329660809d2b0e2da0ff5740306620a02f5385c1587f6
SSDEEP

49152:2fDxOQqd/DCXmsbgt+KsriYGHWNN6eS3BT4O/Rf5iH0TBwDAx:6O/OWsbdlGHWNN6e4j/R5iHSx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b20ec815c2f96f545d59d0686719dac4a0f4809107302478b117f60ccd870805

Files

b20ec815c2f96f545d59d0686719dac4a0f4809107302478b117f60ccd870805
.dll regsvr32 windows:5 windows x86 arch:x86

f37b60c552ebdd3d48e323b62937fd05

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\SourceCode\ALC_WIN32_V2\Lib\Win32\Release\DDMediaFilter.pdb

Imports

kernel32

SetEvent
ExitThread
SetEnvironmentVariableA
IsBadReadPtr
LeaveCriticalSection
EnterCriticalSection
GetTimeZoneInformation
Sleep
GetLocaleInfoW
GetCurrentThreadId
WaitForMultipleObjects
CreateThread
CreateEventW
ResumeThread
CloseHandle
IsBadWritePtr
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSection
CompareStringW
MulDiv
IsDBCSLeadByteEx
DecodePointer
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetLastError
HeapFree
EncodePointer
HeapAlloc
RaiseException
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
RtlUnwind
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetModuleHandleW
SetLastError
InterlockedDecrement
GetProcAddress
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
GetModuleFileNameW
CreateFileW
SetFilePointer
WriteConsoleW
MultiByteToWideChar
SetStdHandle
FlushFileBuffers
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapReAlloc
FreeLibrary
InterlockedExchange
LoadLibraryW
SetEndOfFile
GetProcessHeap
ReadFile
GetStringTypeW
LCMapStringW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
lstrlenA
lstrlenW
GetVersionExW
DisableThreadLibraryCalls
VirtualFree
lstrcmpW
ReleaseSemaphore
VirtualAlloc
ResetEvent
GetSystemInfo
GetProcessAffinityMask
CreateSemaphoreA
CreateEventA
GetModuleHandleA
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
CreateFileA

user32

SetWindowLongW
GetWindowLongW
InvalidateRect
DestroyWindow
LoadStringW
ShowWindow
GetWindowRect
LoadIconW
DestroyIcon
DrawTextW
DrawIconEx
SetRectEmpty
PostMessageW
ReleaseDC
GetDC
CreateDialogParamW
DefWindowProcW
MoveWindow
GetDesktopWindow

gdi32

CreateFontIndirectW
GetDeviceCaps
GetObjectW
GetStockObject
CreateDIBSection
SetTextColor
SetBkMode
DeleteDC
SelectObject
CreateCompatibleDC
DeleteObject
SetBitmapBits

ole32

StringFromGUID2
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
CoInitialize
CoFreeUnusedLibraries
CoUninitialize

winmm

timeGetTime

advapi32

RegCreateKeyW
RegDeleteKeyW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegSetValueExW
RegSetValueW

ws2_32

ntohl
htons
htonl
ntohs

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text.un
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 311KB - Virtual size: 310KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.eh_fram
Size: 156KB - Virtual size: 156KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rodata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.debug_a
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.debug_i
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.debug_l
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.debug_f
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.debug_l
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.debug_p
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.debug_p
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.debug_a
Size: 1024B - Virtual size: 544B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.debug_s
Size: 512B - Virtual size: 233B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.debug_r
Size: 1024B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f37b60c552ebdd3d48e323b62937fd05

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

ole32

winmm

advapi32

ws2_32

Exports

Exports

Sections

.text Size: 2.3MB - Virtual size: 2.3MB

.text.un Size: 46KB - Virtual size: 45KB

.rdata Size: 311KB - Virtual size: 310KB

.data Size: 15KB - Virtual size: 1.8MB

.eh_fram Size: 156KB - Virtual size: 156KB

.rodata Size: 2KB - Virtual size: 2KB

.debug_a Size: 5KB - Virtual size: 4KB

.debug_i Size: 20KB - Virtual size: 19KB

.debug_l Size: 7KB - Virtual size: 7KB

.debug_f Size: 3KB - Virtual size: 3KB

.debug_l Size: 31KB - Virtual size: 30KB

.debug_p Size: 1KB - Virtual size: 1KB

.debug_p Size: 1KB - Virtual size: 1KB

.debug_a Size: 1024B - Virtual size: 544B

.debug_s Size: 512B - Virtual size: 233B

.debug_r Size: 1024B - Virtual size: 912B

.rsrc Size: 32KB - Virtual size: 31KB

.reloc Size: 57KB - Virtual size: 57KB

.text
Size: 2.3MB - Virtual size: 2.3MB

.text.un
Size: 46KB - Virtual size: 45KB

.rdata
Size: 311KB - Virtual size: 310KB

.data
Size: 15KB - Virtual size: 1.8MB

.eh_fram
Size: 156KB - Virtual size: 156KB

.rodata
Size: 2KB - Virtual size: 2KB

.debug_a
Size: 5KB - Virtual size: 4KB

.debug_i
Size: 20KB - Virtual size: 19KB

.debug_l
Size: 7KB - Virtual size: 7KB

.debug_f
Size: 3KB - Virtual size: 3KB

.debug_l
Size: 31KB - Virtual size: 30KB

.debug_p
Size: 1KB - Virtual size: 1KB

.debug_p
Size: 1KB - Virtual size: 1KB

.debug_a
Size: 1024B - Virtual size: 544B

.debug_s
Size: 512B - Virtual size: 233B

.debug_r
Size: 1024B - Virtual size: 912B

.rsrc
Size: 32KB - Virtual size: 31KB

.reloc
Size: 57KB - Virtual size: 57KB