0ea3de245349efd3945f8b55703437570a406bce4e1f725e99e85558cdd24694 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0ea3de245349efd3945f8b55703437570a406bce4e1f725e99e85558cdd24694
Size

1.8MB
MD5

0df84f57b447c74c7c967ebb243d1438
SHA1

6064a53b6626247863fd875b54e15a030f65265d
SHA256

0ea3de245349efd3945f8b55703437570a406bce4e1f725e99e85558cdd24694
SHA512

3f51a159a25a67ae483734b194d44b7d360767907a0d3f61f1130a0ed1a0a28c3371f0ae7297c1c2d18c9867000a8c7107151907a80133e206de1c1e2fee8ebb
SSDEEP

49152:xFhUxzxfco0Ay+CFGs8aLmRR6xvz3zcgKFMT5Dw:nhUH0oAEEar6xvz4Fcpw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0ea3de245349efd3945f8b55703437570a406bce4e1f725e99e85558cdd24694

Files

0ea3de245349efd3945f8b55703437570a406bce4e1f725e99e85558cdd24694
.dll windows x86

5823679726658efb97b5f02b74cc24f6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

version

VerQueryValueA

gdi32

UnrealizeObject

ole32

CoTaskMemFree

comctl32

ImageList_SetIconSize

winspool.drv

SetFormA

shell32

ShellExecuteA

comdlg32

PrintDlgA

common

getTierMode

common2

getDBKind

dbconnect

getADOConnection

wsock32

WSACleanup

plm

ConnPLM

Exports

Exports

CloseForm
StartForm

Sections

CODE
Size: 1.8MB - Virtual size: 12.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 45KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE