6dacd8ef01147243d9e5e25448399850N

Sharing

Copy URL

Twitter E-mail

General

Target

6dacd8ef01147243d9e5e25448399850N
Size

660KB
MD5

6dacd8ef01147243d9e5e25448399850
SHA1

c10987e8fc9fa1046bf2b7fdc04fb3c0191752af
SHA256

7d1b7fe90a9523e9fb69375b953ccac25846900acf630b8b1325019d07852224
SHA512

8ace3c7c0ce32a71feac49aacdc6e26375ab577b5a119b9b5e68b74ec90befecfbe1bf013fb578b5bede30986145df7ba1d4e71222b5227baa27055d7c13fa81
SSDEEP

6144:ebazNBbycfmKsyUlVyMdUFIk1KyHNwoA9pFp5xMqC1hxUxR3KulSsKz3+m:FzeTlVy/7HNWp5WqUhxUxR3KuksKam

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6dacd8ef01147243d9e5e25448399850N

Files

6dacd8ef01147243d9e5e25448399850N
.dll regsvr32 windows:6 windows x86 arch:x86

10b339eba7ed6a12d0c67a18515a94ff

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\print-length\763_Pound\Create_Spot\connect\Once.pdb

Imports

kernel32

VirtualProtect
FindFirstChangeNotificationW
Sleep
DecodePointer
WriteConsoleW
CloseHandle
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
WriteFile
SetStdHandle
HeapReAlloc
HeapSize
GetStringTypeW
GetFileType
GetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
RaiseException
InterlockedFlushSList
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
HeapAlloc
HeapFree
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
CreateFileW

user32

BeginPaint
InvalidateRect
SystemParametersInfoW
SetWindowsHookExW
DestroyMenu
FrameRect
GetWindowTextLengthW
PostMessageW
GetSystemMetrics
RegisterClassExW
OpenClipboard
ClientToScreen
MapWindowPoints
ValidateRect

ole32

CoTaskMemAlloc
CoUninitialize
CoTaskMemFree
CoRegisterClassObject
CoRegisterSurrogate
CoInitialize

Exports

Exports

Bearnight
DllRegisterServer
Inchcamp
Surewhat
Trueparent

Sections

.text
Size: 350KB - Virtual size: 349KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 5.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

10b339eba7ed6a12d0c67a18515a94ff

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 350KB - Virtual size: 349KB

.data Size: 9KB - Virtual size: 5.0MB

.idata Size: 2KB - Virtual size: 2KB

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 350KB - Virtual size: 349KB

.data
Size: 9KB - Virtual size: 5.0MB

.idata
Size: 2KB - Virtual size: 2KB

.reloc
Size: 5KB - Virtual size: 5KB