tmpy2spb3e5 | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

tmpy2spb3e5
Size

402KB
MD5

967497e77171ac87ce0d9a306a7702b5
SHA1

48270d2f65c448b362898b972b3775fd859f0fb3
SHA256

583f67ca7b7301f5524fda8405afcb1d38b481556799d80a633978024577ebab
SHA512

498f3faefdbbb12d3b0170d06b954cffed6cb28889328a85a9394583b22c43908fc0b4debaff717e62e63f9b1e1dd60e73a6acf712e8e0f7b1f1853da20ec116
SSDEEP

6144:XZQPeCI4eVX65RxgmxcI4l6ghclhu2mzt20yhwBdLPrzDh8JHVsmvUw:pQPN/eVX65bgFI4l6J7hhwBVzDK1N

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tmpy2spb3e5

Files

tmpy2spb3e5
.dll windows:4 windows x64 arch:x64

18bc3b4099180bc67dd68352a0d42b48

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

oleaut32

SysStringLen
VariantClear
VariantCopy
SysAllocString
SysAllocStringByteLen
SysFreeString
SysAllocStringLen

user32

CharUpperW

advapi32

SystemFunction036

msvcrt

memset
strlen
__CxxFrameHandler
wcscmp
_purecall
memmove
memcpy
free
_CxxThrowException
malloc
memcmp
realloc
__C_specific_handler
_beginthreadex
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
__dllonexit
_onexit
_initterm

kernel32

InitializeCriticalSection
ReleaseSemaphore
CreateSemaphoreW
ResetEvent
Sleep
CreateEventW
SetThreadAffinityMask
ResumeThread
WaitForSingleObject
SetEvent
IsProcessorFeaturePresent
GetLargePageMinimum
VirtualFree
VirtualAlloc
QueryPerformanceCounter
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GlobalMemoryStatusEx
GetSystemInfo
GetCurrentProcess
GetProcessAffinityMask
WriteFile
ReadFile
GetLastError
CloseHandle
SetFileTime
CreateFileW
SetFileAttributesW
CreateDirectoryW
DeleteFileW
GetCurrentDirectoryW
GetTempPathW
SetLastError
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
GetFileInformationByHandle
FindClose
FindFirstFileW
FindFirstStreamW
FindNextStreamW
GetFileAttributesW

Exports

Exports

CreateDecoder
CreateEncoder
CreateObject
GetHandlerProperty
GetHandlerProperty2
GetHashers
GetIsArc
GetMethodProperty
GetModuleProp
GetNumberOfFormats
GetNumberOfMethods
SetCaseSensitive
SetCodecs
SetLargePageMode

Sections

.text
Size: 306KB - Virtual size: 306KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

18bc3b4099180bc67dd68352a0d42b48

Headers

DLL Characteristics

File Characteristics

Imports

oleaut32

user32

advapi32

msvcrt

kernel32

Exports

Exports

Sections

.text Size: 306KB - Virtual size: 306KB

.rdata Size: 66KB - Virtual size: 65KB

.data Size: 512B - Virtual size: 23KB

.pdata Size: 19KB - Virtual size: 18KB

.rsrc Size: 6KB - Virtual size: 5KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 306KB - Virtual size: 306KB

.rdata
Size: 66KB - Virtual size: 65KB

.data
Size: 512B - Virtual size: 23KB

.pdata
Size: 19KB - Virtual size: 18KB

.rsrc
Size: 6KB - Virtual size: 5KB

.reloc
Size: 3KB - Virtual size: 2KB