ee80acf249244f1141164de26e4bb1613813953d90f2aef5b1afc33c4c44c508N | Triage

Sharing

General

Target

ee80acf249244f1141164de26e4bb1613813953d90f2aef5b1afc33c4c44c508N
Size

10KB
MD5

f56ab671b9bd31441cef1eafd18be4d0
SHA1

634aa1de3c4b31cf0217a836222dc1a7c36c3c12
SHA256

ee80acf249244f1141164de26e4bb1613813953d90f2aef5b1afc33c4c44c508
SHA512

a74222592081349ae84622f0a128cf0b6892c5b69db8c922d88a76175ce45b25c652cdc8a16c6d6f6f11b504aebf7407b5e0647eda1b0274974901ccc269162d
SSDEEP

96:3siiTuOiTOS9SQhGzFjBGhTe3Q0ltHa92EEMRthbJwEtiJwEr+sf1j8e29nqB7A1:3xCQIEhigU49ICthtrtCrr+v9nqlAic

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ee80acf249244f1141164de26e4bb1613813953d90f2aef5b1afc33c4c44c508N

Files

ee80acf249244f1141164de26e4bb1613813953d90f2aef5b1afc33c4c44c508N
.dll regsvr32 windows:5 windows x86 arch:x86

cb9fc98a5d2b1a840fee1a63188f5164

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shlwapi

SHSetValueW
SHDeleteKeyW
SHGetValueW

msvcrt

??3@YAXPAX@Z
wcscpy
??2@YAPAXI@Z
srand
free
_initterm
malloc
_adjust_fdiv
rand
wcsstr
wcslen
memcmp
wcscat
??1type_info@@UAE@XZ

kernel32

IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetModuleFileNameW
InterlockedDecrement
InterlockedIncrement
GetCurrentProcess

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 522B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ