12b6cd99d01fa3b43dc18124e978c833e4bdcd3a05937c3af943f370ea6b6b1a | Triage

Sharing

Copy URL Twitter E-mail

General

Target

12b6cd99d01fa3b43dc18124e978c833e4bdcd3a05937c3af943f370ea6b6b1a
Size

177KB
MD5

bc0c28dbb06ecbc19601a21dd295b5f2
SHA1

026725c51a7db0e0766387d3a4602668a30a5e4e
SHA256

12b6cd99d01fa3b43dc18124e978c833e4bdcd3a05937c3af943f370ea6b6b1a
SHA512

c6732e9880dc9710e16f430a6b1b862991b9638f307644fcf42116acf56927e4d52cfb204681cf49a90645ee1851a5639e1b7468c568ded70ef7c45499c5d37f
SSDEEP

1536:ILyC5rcyBOuUfRC0F0jMZthRFq3JkpqI/oxhZnid8DJ4X7zPJS69qAg3RJ:IuCmyQuLIObnid8DOHPJ+HJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
12b6cd99d01fa3b43dc18124e978c833e4bdcd3a05937c3af943f370ea6b6b1a

Files

12b6cd99d01fa3b43dc18124e978c833e4bdcd3a05937c3af943f370ea6b6b1a
.dll windows:5 windows x86 arch:x86

b380277cbb8ae5571489cb34552d83fd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

accept

kernel32

GetModuleFileNameA
CloseHandle
OutputDebugStringA
LocalFlags
BackupWrite

mprapi

MprInfoDelete
MprAdminMIBServerDisconnect

advapi32

RegOverridePredefKey
AddUsersToEncryptedFile

user32

TranslateMessage
wsprintfW
FindWindowExA
GetWindowThreadProcessId

shlwapi

PathRemoveBlanksW

winspool.drv

AddMonitorW

crypt32

CryptStringToBinaryA

msvcrt

memset

Sections

.text
Size: 122KB - Virtual size: 122KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 123KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ