1d8a344f25dba54db0e3c06d6054dd4495dc4d01391389636a9511129f29ea94

Sharing

Copy URL

Twitter E-mail

General

Target

1d8a344f25dba54db0e3c06d6054dd4495dc4d01391389636a9511129f29ea94
Size

258KB
MD5

3a971e153c56e1e8e71763293d07223f
SHA1

ead0889fdff358ac044768a665a61960d74d4dfa
SHA256

1d8a344f25dba54db0e3c06d6054dd4495dc4d01391389636a9511129f29ea94
SHA512

1a05161490471ab2790a43927ec65bf393c4606989a6451db40887b8aa151df2a1c5180c44cc045279a448df0401698ba630ec374a26f4a3676907e4377b2d34
SSDEEP

6144:fpVRXgS1r0udFYQVTF24x9itdTRNTqX+eNT3G/NdJFNa6xdnsc:hVVgMwuM6FTPEdlNT8+mmNnFN/dn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1d8a344f25dba54db0e3c06d6054dd4495dc4d01391389636a9511129f29ea94

Files

1d8a344f25dba54db0e3c06d6054dd4495dc4d01391389636a9511129f29ea94
.dll windows:6 windows x64 arch:x64

72353607b0ca1865d22b20f6d280df6a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\randuser\source\repos\FxsCompose\x64\Release\FxsCompose.pdb

Imports

kernel32

VirtualAlloc
VirtualProtect
CreateThread
WaitForSingleObject
LoadLibraryW
GetProcAddress
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
UnhandledExceptionFilter

vcruntime140

__std_type_info_destroy_list
__C_specific_handler
memset
memcpy
memmove

api-ms-win-crt-runtime-l1-1-0

_cexit
_execute_onexit_table
_initialize_onexit_table
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
_initialize_narrow_environment

Exports

Exports

DllMain
FaxComposeFreeBuffer
HrAddressBookPreTranslateAccelerator
HrDeInitAddressBook
HrDeinitComposeFormDll
HrFaxComposePreTranslateAccelerator
HrFreeDraftsListViewInfo
HrGetDraftsListViewInfo
HrInitAddressBook
HrInitComposeFormDll
HrInvokeAddressBook
HrNewFaxComposeUI
HrNewFaxComposeUIFromFile
HrNewTiffViewUIFromFile
HrSelectEmailRecipient

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 246KB - Virtual size: 247KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 456B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

72353607b0ca1865d22b20f6d280df6a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 4KB - Virtual size: 3KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 246KB - Virtual size: 247KB

.pdata Size: 512B - Virtual size: 456B

.rsrc Size: 512B - Virtual size: 248B

.reloc Size: 512B - Virtual size: 44B

.text
Size: 4KB - Virtual size: 3KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 246KB - Virtual size: 247KB

.pdata
Size: 512B - Virtual size: 456B

.rsrc
Size: 512B - Virtual size: 248B

.reloc
Size: 512B - Virtual size: 44B