aa1aa7bfccf88d80a0e8dac9f342e0b79a954e0bb5d2a4b77e383a1aeea5e8fcN

Sharing

Copy URL Twitter E-mail

General

Target

aa1aa7bfccf88d80a0e8dac9f342e0b79a954e0bb5d2a4b77e383a1aeea5e8fcN
Size

6KB
MD5

c28293d9f1c1eac853f7d88637d7f370
SHA1

559b5bb20985c15db8ce1eef7c072866d6401da7
SHA256

aa1aa7bfccf88d80a0e8dac9f342e0b79a954e0bb5d2a4b77e383a1aeea5e8fc
SHA512

90c6ad4027fa16de5b348832df387d10be16396253dc04eb05c554860e5308f90eb30c654d60534c700c9a603baad7a577f2ceac99dbc77be793e3fbf0699345
SSDEEP

96:0FHbK/WKl4wLzH9bxZ9pBC94KJ2L6wRUu+y6xIpOu/ssGWjQy7MzcNDpXuHvV+IM:0FHb5nw33Z1i4x+9A6xoqszzNDpXi9DY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/w3tp.dll

Files

aa1aa7bfccf88d80a0e8dac9f342e0b79a954e0bb5d2a4b77e383a1aeea5e8fcN
.cab
w3tp.dll
.dll windows:5 windows x86 arch:x86

d75b7bc409a1e8a95dd85b657339c64c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

w3tp.pdb

Imports

msvcrt

??2@YAPAXI@Z
free
malloc
??3@YAXPAX@Z
_adjust_fdiv
_initterm

ntdll

NtQueryInformationThread
NtQuerySystemInformation

kernel32

DisableThreadLibraryCalls
OutputDebugStringA
GetQueuedCompletionStatus
CreateIoCompletionPort
CloseHandle
InitializeCriticalSectionAndSpinCount
CreateEventW
GetModuleFileNameW
SetEvent
WaitForMultipleObjects
InterlockedDecrement
InterlockedIncrement
LeaveCriticalSection
EnterCriticalSection
Sleep
DeleteTimerQueueTimer
GetTickCount
DeleteCriticalSection
FreeLibraryAndExitThread
GetLastError
LoadLibraryW
CreateThread
CreateTimerQueueTimer
GlobalMemoryStatus
GetSystemInfo
PostQueuedCompletionStatus

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW

iisutil

PuDbgPrint
IISGetPlatformType
PuDeleteDebugPrintsObject
PuCreateDebugPrintsObject

Exports

Exports

??0THREAD_POOL@@AAE@XZ
??1THREAD_POOL@@AAE@XZ
?BindIoCompletionCallback@THREAD_POOL@@QAEHPAXP6GXKKPAU_OVERLAPPED@@@ZK@Z
?CreateThreadPool@THREAD_POOL@@SGHPAPAV1@PAUTHREAD_POOL_CONFIG@@@Z
?GetStats@THREAD_POOL@@QAEXPAK00@Z
?PostCompletion@THREAD_POOL@@QAEHKP6GXKKPAU_OVERLAPPED@@@Z0@Z
?SetInfo@THREAD_POOL@@QAEKW4THREAD_POOL_INFO@@K@Z
?TerminateThreadPool@THREAD_POOL@@QAEXXZ
DllMain
ThreadPoolBindIoCompletionCallback
ThreadPoolGetStats
ThreadPoolInitialize
ThreadPoolPostCompletion
ThreadPoolSetInfo
ThreadPoolTerminate

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 552B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d75b7bc409a1e8a95dd85b657339c64c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

kernel32

advapi32

iisutil

Exports

Exports

Sections

.text Size: 9KB - Virtual size: 9KB

.data Size: 512B - Virtual size: 576B

.rsrc Size: 1024B - Virtual size: 992B

.reloc Size: 1024B - Virtual size: 552B

.text
Size: 9KB - Virtual size: 9KB

.data
Size: 512B - Virtual size: 576B

.rsrc
Size: 1024B - Virtual size: 992B

.reloc
Size: 1024B - Virtual size: 552B