PI ITS15235[.]xll | Triage

Sharing

General

Target

PI ITS15235.xll
Size

3KB
MD5

d137ab6fd155d9db65d23b1dd7aec43e
SHA1

4870806f3fa9d3bb3cd65cfaa9c47f7d83dfaa21
SHA256

ffc0753059b38955158a02220aea934a651977953f07e9cc1b4ea43797d3481b
SHA512

064b9fa2b89bdb0bcf8b0fa00ebb78f9b817f23f1b6ab4d8551541fa64cf6c9a754200a5c2dc184a444d6ecd14ffda6df4c78a8356c0887d7f11e6f090988daf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PI ITS15235.xll

Files

PI ITS15235.xll
.xll windows:1 windows x64 arch:x64

498a635594568c2b530f639a76e1dff1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

CancelWaitableTimer
BackupWrite
DebugActiveProcess
FatalExit
ReadConsoleOutputCharacterW

gdi32

GetWinMetaFileBits
Rectangle
GetPixel
DeleteDC

oleaut32

RevokeActiveObject
VarI4FromR8

user32

EqualRect

Exports

Exports

xlAutoOpen

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 96B

IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ