ef77a55913c377ab0a9fa51b57628cdf1b524ff466ed41b205606db8698c5cdfN | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ef77a55913c377ab0a9fa51b57628cdf1b524ff466ed41b205606db8698c5cdfN
Size

4KB
MD5

2c81ed2b3ac078927652b79e4d961860
SHA1

13047e2040975e287a615af6bf86fa6bea400d84
SHA256

ef77a55913c377ab0a9fa51b57628cdf1b524ff466ed41b205606db8698c5cdf
SHA512

11671cd5dc6ac8f2a7034efcdeee498e321f25f1cca1f67e848600d61dca532b82998af0f6224c5e8f906b46fe8e4d3d016f0240d9e339151903b138c21d19f3
SSDEEP

96:vgbkzFgcbinHhvH5MQIKVMss5qZntlxjYuyOft:YWF8hPGQzVMZ4ZTNoOft

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/imlang.dll

Files

ef77a55913c377ab0a9fa51b57628cdf1b524ff466ed41b205606db8698c5cdfN
.cab
imlang.dll
.dll regsvr32 windows:5 windows x86 arch:x86

57c26b86303af3314fc01777ecb3cd26

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_adjust_fdiv
malloc
_initterm
free
wcstombs
memmove
??3@YAXPAX@Z
??2@YAPAXI@Z

kernel32

Sleep
GetModuleFileNameA
lstrcpyA
lstrcatA
GlobalLock
GlobalAlloc
GlobalFree
GlobalUnlock
GlobalHandle
InterlockedIncrement
InterlockedDecrement
lstrlenA

advapi32

RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegEnumKeyExA
RegCloseKey
RegDeleteKeyA

ole32

CoTaskMemFree
CoCreateInstance
StringFromCLSID
StringFromGUID2

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 592B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ