af4fe76c32100fa9d3e0a04dff51de30N[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

af4fe76c32100fa9d3e0a04dff51de30N.exe
Size

241KB
MD5

af4fe76c32100fa9d3e0a04dff51de30
SHA1

2b9ac8c5f47f224fdb1d3c1032e4224f1a671d3e
SHA256

bdadd9b2c155333553f7f52650259a8914c27993fc9282f63e543451b93846de
SHA512

c2bc1fa8798b886b62331b18b307ae4bd4c087d6fb74a42bdee1db0400870a8301fce36592f2c3be1a595cfaaa8ac15e3917e6bf382d2a61e0f50bea94dd87ef
SSDEEP

6144:StTAOBzy/SEUbKZDpmH/Gjihp2qA0S3B:StkOBzkSE8KrmH/y90i

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
af4fe76c32100fa9d3e0a04dff51de30N.exe

Files

af4fe76c32100fa9d3e0a04dff51de30N.exe
.dll regsvr32 windows:10 windows x86 arch:x86

2edc6a8ed3f7815ff496f82fb6b7889a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

dmscript.pdb

Imports

ntdll

wcstoul
_ultow
wcsstr
wcstombs
memset
iswascii
RtlUnwind
_stricmp
_wcsicmp
tolower
_CIpow
_CIsqrt
_alldiv
_ftol2_sse
_alloca_probe

msvcrt

_CxxThrowException
__CxxFrameHandler3
memcpy
??0exception@@QAE@ABQBD@Z
_callnewh
malloc
_beginthreadex
_endthreadex
??0exception@@QAE@ABV0@@Z
_XcptFilter
??1type_info@@UAE@XZ
_onexit
__dllonexit
??3@YAXPAX@Z
_unlock
_lock
??_V@YAXPAX@Z
_amsg_exit
_initterm
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
free
??0exception@@QAE@ABQBDH@Z
_purecall
memmove

api-ms-win-core-com-l1-1-0

CoUninitialize
CLSIDFromProgID
StringFromCLSID
CoTaskMemFree
CoCreateInstance
CoInitializeEx

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-registry-l1-1-0

RegCreateKeyExA
RegOpenKeyExA
RegCloseKey
RegSetValueExA

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
DisableThreadLibraryCalls
GetProcAddress

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
SetEvent
CreateEventA
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryA

api-ms-win-core-registry-l2-1-0

RegEnumKeyA
RegDeleteKeyA

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 89KB - Virtual size: 88KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 144KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2edc6a8ed3f7815ff496f82fb6b7889a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntdll

msvcrt

api-ms-win-core-com-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-registry-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-profile-l1-1-0

Exports

Exports

Sections

.text Size: 89KB - Virtual size: 88KB

.data Size: 2KB - Virtual size: 3KB

.idata Size: 3KB - Virtual size: 2KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 144KB - Virtual size: 144KB

.text
Size: 89KB - Virtual size: 88KB

.data
Size: 2KB - Virtual size: 3KB

.idata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 144KB - Virtual size: 144KB