61197e2e4935fb906dfb8904024a7b7d78e931b4746e45b7d2b6d688d570300d

Sharing

Copy URL Twitter E-mail

General

Target

61197e2e4935fb906dfb8904024a7b7d78e931b4746e45b7d2b6d688d570300d
Size

203KB
MD5

25312bee6de8d40ef85e8aa79db1f832
SHA1

bce97c9ed5da2c1d7aecaf67edaa5b30652ca739
SHA256

61197e2e4935fb906dfb8904024a7b7d78e931b4746e45b7d2b6d688d570300d
SHA512

7d8d11804dd6b883ef8c82a16612661e2ce9eee0e8b00be9e7fe2ae0813dc702687b68ae7dba61b1ae7074fc5f18b8d45f6014301b5a5a01695a7d2aeb0890b5
SSDEEP

3072:Ypvr+mYIu4Mv3Oi1GshnyNSsGH7FXw1o0FisTjgCg6YObl0Zw1ovKav:Ypv1YY0uOnyosIJXw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
61197e2e4935fb906dfb8904024a7b7d78e931b4746e45b7d2b6d688d570300d

Files

61197e2e4935fb906dfb8904024a7b7d78e931b4746e45b7d2b6d688d570300d
.dll windows:6 windows x64 arch:x64

3e7942189722ad3a710ed792f71cb701

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

F:\NMC\CURRENT768nightlyBuild16159_final\Libraries\WzWXF\Providers\WzWXFRecipients\w64prod\WzAddrycts64.pdb

Imports

vcruntime140

__std_type_info_destroy_list
memcpy
_CxxThrowException
__std_exception_destroy
__std_exception_copy
__C_specific_handler
__CxxQueryExceptionSize
__CxxExceptionFilter
__CxxRegisterExceptionObject
__CxxDetectRethrow
__CxxUnregisterExceptionObject
__FrameUnwindFilter
wcsstr
__current_exception_context
__current_exception
wcsrchr
_purecall
memset
__CxxFrameHandler3

api-ms-win-crt-string-l1-1-0

wcscat_s
wcscpy_s
_wcsdup
_wcslwr_s
wcsncpy_s
_wcsnicmp
_wcsicmp
wcsncmp

api-ms-win-crt-heap-l1-1-0

free
_callnewh
malloc

api-ms-win-crt-runtime-l1-1-0

terminate
_cexit
_crt_at_quick_exit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
abort

user32

IsWindow
LoadBitmapW

kernel32

GetUserDefaultUILanguage
Sleep
DeactivateActCtx
GetProcAddress
ActivateActCtx
TerminateProcess
GetCurrentProcess
SearchPathW
SetLastError
GetSystemDefaultUILanguage
GetLocaleInfoEx
GetLocaleInfoW
CreateFileW
GetVersionExW
UnmapViewOfFile
LCIDToLocaleName
MultiByteToWideChar
CloseHandle
FindResourceExW
LoadResource
LocaleNameToLCID
CreateFileMappingW
MapViewOfFile
LoadLibraryExW
VerifyVersionInfoW
VerSetConditionMask
FreeLibrary
SetThreadUILanguage
GetModuleHandleW
IsProcessorFeaturePresent
GetModuleFileNameW
CreateActCtxW
ReleaseActCtx
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW

api-ms-win-crt-convert-l1-1-0

_wtoi

api-ms-win-crt-filesystem-l1-1-0

_wsplitpath_s
_wmakepath_s

advapi32

RegEnumValueW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_p
__stdio_common_vsnprintf_s
__stdio_common_vsprintf_s
__stdio_common_vsprintf
__stdio_common_vfscanf
__stdio_common_vfprintf_p
__stdio_common_vsscanf
__stdio_common_vfprintf_s
__stdio_common_vfprintf
__acrt_iob_func
__stdio_common_vfwprintf
__stdio_common_vfwprintf_s
__stdio_common_vfwprintf_p
__stdio_common_vfwscanf
__stdio_common_vswprintf
__stdio_common_vswprintf_s
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf_p
__stdio_common_vswscanf

mscoree

_CorDllMain

Exports

Exports

CreateWzWXFProvider
GetInterfaceVersion

Sections

.text
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.nep
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 106KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3e7942189722ad3a710ed792f71cb701

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

user32

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

advapi32

api-ms-win-crt-stdio-l1-1-0

mscoree

Exports

Exports

Sections

.text Size: 47KB - Virtual size: 47KB

.nep Size: 3KB - Virtual size: 2KB

.rdata Size: 106KB - Virtual size: 106KB

.data Size: 5KB - Virtual size: 6KB

.pdata Size: 3KB - Virtual size: 3KB

.rsrc Size: 36KB - Virtual size: 35KB

.reloc Size: 1024B - Virtual size: 984B

.text
Size: 47KB - Virtual size: 47KB

.nep
Size: 3KB - Virtual size: 2KB

.rdata
Size: 106KB - Virtual size: 106KB

.data
Size: 5KB - Virtual size: 6KB

.pdata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 36KB - Virtual size: 35KB

.reloc
Size: 1024B - Virtual size: 984B