e59f939ffa6081ff620aacf44295119c59266251af3ababbd3fd0fccd23b1aacN

Sharing

Copy URL Twitter E-mail

General

Target

e59f939ffa6081ff620aacf44295119c59266251af3ababbd3fd0fccd23b1aacN
Size

7KB
MD5

cb2d45580989ec8e5390eb82aced2d20
SHA1

0d62b5b69d2ee139162ff4d56bfa84366f34099e
SHA256

e59f939ffa6081ff620aacf44295119c59266251af3ababbd3fd0fccd23b1aac
SHA512

952297ce2410bf76536404c718c4e975837538c219065771b43fba2236ac7a0f8232da46422b5fe90e00a1a92def7279004a4ef33b856375be9bb3ea146b6080
SSDEEP

192:G5Co0vHZGOunkaPqi3qyAzljmRnyGAsjrQxkf:GF0fQZkaPlq5xmRnyRZkf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/qmgrprxy.dll

Files

e59f939ffa6081ff620aacf44295119c59266251af3ababbd3fd0fccd23b1aacN
.cab
qmgrprxy.dll
.dll regsvr32 windows:5 windows x86 arch:x86

b1407e413ad23091c12de123d6556a34

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

qmgrprxy.pdb

Imports

msvcrt

_except_handler3
?terminate@@YAXXZ
_CxxThrowException
free
_initterm
malloc
??1type_info@@UAE@XZ
??3@YAXPAX@Z
_adjust_fdiv
__CxxFrameHandler

rpcrt4

CStdStubBuffer_DebugServerRelease
CStdStubBuffer_CountRefs
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
CStdStubBuffer_Disconnect
CStdStubBuffer_Connect
CStdStubBuffer_AddRef
CStdStubBuffer_QueryInterface
IUnknown_Release_Proxy
IUnknown_AddRef_Proxy
IUnknown_QueryInterface_Proxy
NdrOleFree
NdrOleAllocate
NdrClientCall2
NdrDllUnregisterProxy
NdrDllRegisterProxy
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
CStdStubBuffer_DebugServerQueryInterface

oleaut32

BSTR_UserSize
BSTR_UserMarshal
BSTR_UserFree
VARIANT_UserSize
VARIANT_UserMarshal
VARIANT_UserUnmarshal
VARIANT_UserFree
BSTR_UserUnmarshal

ole32

CoCreateInstance
CLSIDFromString

kernel32

Sleep
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 1024B - Virtual size: 658B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b1407e413ad23091c12de123d6556a34

Headers

File Characteristics

PDB Paths

Imports

msvcrt

rpcrt4

oleaut32

ole32

kernel32

Exports

Exports

Sections

.text Size: 13KB - Virtual size: 12KB

.orpc Size: 1024B - Virtual size: 658B

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 13KB - Virtual size: 12KB

.orpc
Size: 1024B - Virtual size: 658B

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB