032fc33b05e26e801bea7340fcd63bce5fceb0b063f9575a2ab68900a07df44cN

Sharing

Copy URL

Twitter E-mail

General

Target

032fc33b05e26e801bea7340fcd63bce5fceb0b063f9575a2ab68900a07df44cN
Size

12KB
MD5

4d34ac43551bd6bcf67db43b487336d0
SHA1

7aaba18a4c8dc8b7634ac36a88f675f91df9990c
SHA256

032fc33b05e26e801bea7340fcd63bce5fceb0b063f9575a2ab68900a07df44c
SHA512

aedead353044255a4a0c55fe647a7f8cd3f1f89e34ea9bb796132b8ca761c39f9a287cca128a0acc382870eb67ec95b030ac34916c2ca6a7125297cb4ee6fd0e
SSDEEP

192:FepuBucqjzwROLEh/F0035eedk+F5dIbAJbHf896d9NQGYFoSbgTAIwLu:oEqPCOojkCdIcdHfPYH0MIwLu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/compfilt.dll

Files

032fc33b05e26e801bea7340fcd63bce5fceb0b063f9575a2ab68900a07df44cN
.cab
compfilt.dll
.dll regsvr32 windows:5 windows x86 arch:x86

0d27346727f4926772973d71c7483b6f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

compfilt.pdb

Imports

msvcrt

strncmp
??2@YAPAXI@Z
strchr
wcslen
wcscpy
??3@YAXPAX@Z
_wcsicmp

iisrtl

IISInitializeCriticalSection

advapi32

GetSecurityDescriptorLength

kernel32

GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
EnterCriticalSection
LeaveCriticalSection
SetLastError
FreeLibrary
DeleteCriticalSection
LocalFree
CloseHandle
WaitForSingleObject
ExpandEnvironmentStringsW
WideCharToMultiByte
LocalAlloc
GetProcAddress
LoadLibraryA
InterlockedIncrement
FindClose
FindNextFileA
InterlockedExchangeAdd
FindFirstFileA
GetVolumeInformationA
CreateDirectoryA
GetFileAttributesExA
InterlockedDecrement
RemoveDirectoryA
DeleteFileA
FileTimeToSystemTime
CompareFileTime
WriteFile
IsDBCSLeadByte
MoveFileExA
SetFileAttributesA
SetFileTime
GetOverlappedResult
GetLastError
ReadFile
CreateFileA
GetModuleHandleA
Sleep
SetEvent
SetThreadPriority
CreateThread
CreateEventA
DisableThreadLibraryCalls
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess

user32

CharPrevExA
LoadStringA

ole32

CoInitializeEx
CoInitialize
CoUninitialize
CoGetClassObject

infocomm

TsCloseHandle
?QueryFileHandle@TS_OPEN_FILE_INFO@@QAEPAXXZ
TsCreateFile

Exports

Exports

??4ALLOC_CACHE_HANDLER@@QAEAAV0@ABV0@@Z
??4TSVC_CACHE@@QAEAAV0@ABV0@@Z
?GetInstanceId@TSVC_CACHE@@QBEKXZ
?GetServerInstance@TSVC_CACHE@@QBEPAXXZ
?GetServiceId@TSVC_CACHE@@QBEKXZ
?IsValid@ALLOC_CACHE_HANDLER@@QBEHXZ
?IsValid@TS_OPEN_FILE_INFO@@QBEHXZ
?Lock@ALLOC_CACHE_HANDLER@@AAEXXZ
?QueryAttributes@TS_OPEN_FILE_INFO@@QBEKXZ
?QueryETag@TS_OPEN_FILE_INFO@@QBEPADXZ
?QueryLastWriteTime@TS_OPEN_FILE_INFO@@QBEHPAU_FILETIME@@@Z
?QuerySize@TS_OPEN_FILE_INFO@@QBEHAAT_LARGE_INTEGER@@@Z
?QuerySize@TS_OPEN_FILE_INFO@@QBEHPAK0@Z
?RetrieveHttpInfo@TS_OPEN_FILE_INFO@@QAEHPADPAH@Z
?SetParameters@TSVC_CACHE@@QAEXKKPAX@Z
?Unlock@ALLOC_CACHE_HANDLER@@AAEXXZ
?WeakETag@TS_OPEN_FILE_INFO@@QBEHXZ
DllRegisterServer
GetFilterVersion
HttpFilterProc
TerminateFilter

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0d27346727f4926772973d71c7483b6f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

iisrtl

advapi32

kernel32

user32

ole32

infocomm

Exports

Exports

Sections

.text Size: 17KB - Virtual size: 17KB

.data Size: 2KB - Virtual size: 2KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 17KB - Virtual size: 17KB

.data
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB