0ef71569308d44e89bde48096c67caf73ec177c1c970a2fd843fd3a094502d78 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0ef71569308d44e89bde48096c67caf73ec177c1c970a2fd843fd3a094502d78
Size

14KB
MD5

dc42ed8e1de55185c9240f33863a6aa4
SHA1

7b969c7cd3a5a54006b7f6837e3ef3344890659c
SHA256

0ef71569308d44e89bde48096c67caf73ec177c1c970a2fd843fd3a094502d78
SHA512

e2e54d4fb5b9590d96c543407d95f7f7b13540b96e6226204a617afda36ec0c627bd1117c3959662d2b791676fec3dc2e6e00de31feb9277c27b336c20a06151
SSDEEP

192:pOJ2Sc8d12+z8zhLmztVnwcilebyt6r9XAy615CSKH+S6P4WB:a/c8RU6zHnQayt6r9XXsCTHQX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0ef71569308d44e89bde48096c67caf73ec177c1c970a2fd843fd3a094502d78

Files

0ef71569308d44e89bde48096c67caf73ec177c1c970a2fd843fd3a094502d78
.dll windows x86

38198a29842dfbdd983b882807fcc3b2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msxfs

WFSExecute
WFSLock
WFSUnlock
WFSFreeResult

shlwapi

StrToIntW
PathFileExistsW

kernel32

GetModuleHandleW
CloseHandle
lstrcmpiW
GetModuleFileNameA
GetProcAddress
lstrcpyA
lstrcpyW
GetCurrentProcess
VirtualFreeEx
VirtualProtectEx
VirtualAllocEx
WriteProcessMemory
SetFilePointer
lstrlenA
lstrcpynA
lstrlenW
GetPrivateProfileStringW
WriteFile
LoadLibraryW
CreateFileW
DeleteFileW

user32

wsprintfA

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 555B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 790B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ