4fba66b9e3e2196d6709a5684f2f7a7e960f224b79eb4d2716cd737e2a3a87a1 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4fba66b9e3e2196d6709a5684f2f7a7e960f224b79eb4d2716cd737e2a3a87a1
Size

2.0MB
MD5

6f34204851bed1745d86a983f94fdc93
SHA1

06c3f2e4bff4b05c011a91da9899342b1eeeb3e5
SHA256

4fba66b9e3e2196d6709a5684f2f7a7e960f224b79eb4d2716cd737e2a3a87a1
SHA512

1e84d41faaa7d4b6e1796a63d0c6dfa37b2390bf9c9631de25a3c0958d39ff8efafd7f159ecfaedfd35ce2650f1eb41a62ffedaa5b5f51b7b7b1460fa40eab3f
SSDEEP

49152:Kx+W32kqmUu6+WX+WRQiKcfvPbkoL9G21T5Ul:KA1k6XtKAnYoLv1TK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4fba66b9e3e2196d6709a5684f2f7a7e960f224b79eb4d2716cd737e2a3a87a1

Files

4fba66b9e3e2196d6709a5684f2f7a7e960f224b79eb4d2716cd737e2a3a87a1
.dll windows x86

6e6cc283745b5c32093b7dff7cfa89af

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

version

VerQueryValueA

gdi32

UnrealizeObject

ole32

CoTaskMemFree

comctl32

ImageList_SetIconSize

winspool.drv

SetFormA

shell32

ShellExecuteA

comdlg32

PrintDlgA

common

getTierMode

common2

getDBKind

dbconnect

getADOConnection

plm

ConnPLM

Exports

Exports

CloseForm
StartForm

Sections

CODE
Size: 2.0MB - Virtual size: 14.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 55KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE