SecuriteInfo[.]com[.]Win32[.]Malware-gen[.]19054[.]13309 | Triage

Sharing

General

Target

SecuriteInfo.com.Win32.Malware-gen.19054.13309
Size

2.5MB
MD5

993fffa2defb74bcd0a6ec548e1498ac
SHA1

860bea512038484aef8449b6689695fbf609f56c
SHA256

054bfdf51d00ace3d88ce1be54d91f4b5ea8e2d239f523ba0ee5878c844938d7
SHA512

46b2818a037fec961e9ee99bd991a448ffba1d8165a8981cb2ac4baced71906d07351f12af311c88e4dc0c5df4c24ba3f95918602e354447715e58b2c6008801
SSDEEP

49152:RrNhFBmfJ5DRGpL1bNvcN5yn8d4we/pPIMD4AOcCrsQYpn3d5lGhGoKJ:NzFSziL1iy2zWxOrrYp3d7nJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SecuriteInfo.com.Win32.Malware-gen.19054.13309

Files

SecuriteInfo.com.Win32.Malware-gen.19054.13309
.dll windows x86

f20c5c2422673b45947cdcb317612f73

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WaitForSingleObject
TerminateProcess
InterlockedPushEntrySList
LoadLibraryA
LoadLibraryExW
OutputDebugStringA
GetModuleFileNameA
GetBinaryTypeA

rpcrt4

NdrConformantArrayMarshall

oleaut32

VarBstrCmp

user32

CharLowerBuffA
GetUpdateRgn

Sections

.text
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 782B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 60KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.code
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.crt
Size: 352KB - Virtual size: 350KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 880B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ