MDE_File_Sample_16cc3e1216e03bf341e1f0dcf5da4251a1827405[.]zip

General

Target

MDE_File_Sample_16cc3e1216e03bf341e1f0dcf5da4251a1827405.zip
Size

1.1MB
MD5

a7f798a9ea469dc4bfd1534f34395ddd
SHA1

9fff7882f02413b6318c6291fe6e20e8e4057dee
SHA256

3fb04579329f1dbec58bbb93e3ab557d1643c1b6d44e677caa1f95f7444f24c7
SHA512

aa8cfb38349035e61a062474b904e438cc859ca130752d4a645e2403e575cda0a33a93c175817a6291b1b2a84e92ef31eb2ef363d276fcc59cac2770380c8752
SSDEEP

24576:XeAkkS+Z7iBUhBsyD/vQq720e+Kq9uOaqlxNCbuqKgCFcZJIHsE50bz4RBzb0j:XjhkB8Bsy/vb720MEgqlxEKgCOIHT5eF

Score

N/A

MDE_File_Sample_16cc3e1216e03bf341e1f0dcf5da4251a1827405.zip
.zip

Password: infected
MSI7914.tmp
.dll windows x86

83e5c1cbdfe899428caca84f8d509bf6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

socket

gdi32

GetTextMetricsA

kernel32

GetBinaryTypeW
VirtualProtect
GetEnvironmentStringsW
IsValidLanguageGroup
CloseHandle
GetModuleFileNameW

user32

GetWindowTextW
MessageBoxA

secur32

InitializeSecurityContextW

msvcrt

fseek

Sections

.text
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 216KB - Virtual size: 216KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ