shampoo[.]exe[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

shampoo.exe.dll
Size

2.0MB
MD5

40440ade44d16b4c1f2de198e2bb8682
SHA1

a2e92a74905f2d8406a1e9aebc47d7c52e37eab7
SHA256

ea5a5dd9b89a9238faa52829c10f8cd38ccf01150928a6f24b06c79fa926d83f
SHA512

58d5e861755c8899447fcdfbe860253e0f1cd63f945ff543e859b378f74319f38928cee32414468a18924dc2cb20f480a8b36e8c19c1f12416e159fb3c2bc794
SSDEEP

24576:28w2G6Cj60yD3o/4T3k+gaW44ZkNZHvmyCn4nweia:Jwx6CGm4TNZHvmH4D

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
shampoo.exe.dll

Files

shampoo.exe.dll
.dll windows x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorDllMain

Exports

Exports

__current_exception
__current_exception_context
_except_handler4_common
memchr
memcpy
memmove
memset
strchr
strrchr
strstr
wcsrchr

Sections

.text
Size: 244KB - Virtual size: 243KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 343B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ