61bd3e18a458fe57f4c6053bb584fbd983086d844b2915b89ad564fc10d9efdf

General

Target

61bd3e18a458fe57f4c6053bb584fbd983086d844b2915b89ad564fc10d9efdf
Size

633KB
MD5

afaddd3f8eb75ea43f3fa3f216f28f6b
SHA1

683e6b2e4a1a842e55f989ffa87bc546afdba7d2
SHA256

61bd3e18a458fe57f4c6053bb584fbd983086d844b2915b89ad564fc10d9efdf
SHA512

199c062e8da858eabbf8c0bff2374d6c7cebfc6ad116b71ff436f2ada0b7f057a7f330de4dee0eba3fd5560add7d736355fdab65e918a00be93a93e746b9a6bf
SSDEEP

6144:l6VqiK7MKVdvWp+WNKPWpK/yjBZca2/Zwjx0yTB:lZfVdvwGwKa+E

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
61bd3e18a458fe57f4c6053bb584fbd983086d844b2915b89ad564fc10d9efdf

Files

61bd3e18a458fe57f4c6053bb584fbd983086d844b2915b89ad564fc10d9efdf
.dll windows:6 windows x64 arch:x64

04256aa36376c194bb97b834f6191084

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

d:\thpgl2\src\core\vayu\products\lfp\ui\src\objfre\amd64\hpircDAP.pdb

Imports

kernel32

FlsSetValue
GetCommandLineA
GetVersionExW
GetProcAddress
GetModuleHandleW
ExitProcess
EncodePointer
DecodePointer
FlsFree
SetLastError
FlsGetValue
GetLastError
GetCurrentThreadId
FlsAlloc
HeapFree
HeapAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlUnwindEx
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WriteFile
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringA
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
Sleep
LoadLibraryExW
GetStringTypeW
MultiByteToWideChar
LCMapStringW
VirtualProtect
VirtualAlloc
SetThreadStackGuarantee
GetSystemInfo
VirtualQuery

Exports

Exports

DllMain

Sections

.text
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 594KB - Virtual size: 593KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

04256aa36376c194bb97b834f6191084

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

Exports

Exports

Sections

.text Size: 29KB - Virtual size: 29KB

.data Size: 5KB - Virtual size: 8KB

.pdata Size: 1KB - Virtual size: 1KB

.rsrc Size: 594KB - Virtual size: 593KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 29KB - Virtual size: 29KB

.data
Size: 5KB - Virtual size: 8KB

.pdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 594KB - Virtual size: 593KB

.reloc
Size: 2KB - Virtual size: 2KB