ebb7ab4e6b7c72b20658236692a4e4a81a051623f8126b906713897b4abdbc5c

Sharing

Copy URL Twitter E-mail

General

Target

ebb7ab4e6b7c72b20658236692a4e4a81a051623f8126b906713897b4abdbc5c
Size

397KB
MD5

3b4b5202a7ebd520351a1a3424e98f77
SHA1

0a75b821453f6bc871845095a2c7aa9b0b690e53
SHA256

ebb7ab4e6b7c72b20658236692a4e4a81a051623f8126b906713897b4abdbc5c
SHA512

d74b69f992758d49e4e6be10623368ee467b9ca1d9f33ba4848a300ad102931f4a27eb50be5a9114210c78ae1fe7c0dd700a3f106ae33b11699b7915fa25b66c
SSDEEP

6144:xdIECQhyPTlrbnLuv/k7a7jTYpuvT+ZX1NlMYI4oc:gECQhyrlrbnS072Up2ANlMYI4oc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ebb7ab4e6b7c72b20658236692a4e4a81a051623f8126b906713897b4abdbc5c

Files

ebb7ab4e6b7c72b20658236692a4e4a81a051623f8126b906713897b4abdbc5c
.dll windows:6 windows x86 arch:x86

fe83dfa0e25bec15f3f63c10d558fc6e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\builds\moz2_slave\rel-m-rel-xr_w32_bld-000000000\build\obj-firefox\security\nss\lib\ckfw\builtins\nssckbi.pdb

Imports

nss3

PL_strlen
PR_CallOnce
PR_GetThreadPrivate
PR_NewThreadPrivateIndex
PL_ArenaAllocate
PL_FinishArenaPool
PL_InitArenaPool
PR_SetThreadPrivate
PR_Free
PR_Calloc
PR_Unlock
PR_Lock
PR_DestroyLock
PR_NewLock
PL_CompareValues
PL_HashTableEnumerateEntries
PL_HashTableLookup
PL_HashTableRemove
PL_HashTableAdd
PL_HashTableDestroy
PL_NewHashTable

msvcr120

__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
_except_handler4_common
__clean_type_info_names_internal
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
_initterm_e
_initterm
_malloc_crt
memcmp
memcpy
memset
memmove
__CppXcptFilter
_amsg_exit

mozglue

frex

kernel32

IsProcessorFeaturePresent
IsDebuggerPresent
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
DecodePointer
EncodePointer

Exports

Exports

C_GetFunctionList

Sections

.text
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 319KB - Virtual size: 319KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fe83dfa0e25bec15f3f63c10d558fc6e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

nss3

msvcr120

mozglue

kernel32

Exports

Exports

Sections

.text Size: 40KB - Virtual size: 39KB

.rdata Size: 319KB - Virtual size: 319KB

.data Size: 24KB - Virtual size: 24KB

.rsrc Size: 1024B - Virtual size: 768B

.reloc Size: 12KB - Virtual size: 11KB

.text
Size: 40KB - Virtual size: 39KB

.rdata
Size: 319KB - Virtual size: 319KB

.data
Size: 24KB - Virtual size: 24KB

.rsrc
Size: 1024B - Virtual size: 768B

.reloc
Size: 12KB - Virtual size: 11KB