SecuriteInfo[.]com[.]not-a-virus[.]RiskTool[.]Win32[.]Agent[.]anpo[.]8193[.]1217 | Triage

Sharing

General

Target

SecuriteInfo.com.not-a-virus.RiskTool.Win32.Agent.anpo.8193.1217
Size

1.0MB
MD5

f0864e871dcd63dc8b362e5211f9288c
SHA1

65f37b4b22847ba7b54e0a7af71809ded43e4be6
SHA256

5aa2adb42fabd6aa03a954d7f237163913d5226638268ea4a3113d75c7947151
SHA512

32315507987f7bdc0e0c519cf2b51a178a3ade6cada4305e557050e14547d9d1e29e49cd435d84bebfcf3aecd75a5075b19be5273adb40dcddb8e8daf36909ea
SSDEEP

12288:2M+t4646v7nbX+n8iuEqFR+ZSwikmakYIXcdb+v+MLCioiioQDp:Et46xOn8HFRQU+8O

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SecuriteInfo.com.not-a-virus.RiskTool.Win32.Agent.anpo.8193.1217

Files

SecuriteInfo.com.not-a-virus.RiskTool.Win32.Agent.anpo.8193.1217
.dll windows x86

eb64368ee3257c14a038edaa28158029

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleA
GetProcAddress

user32

mouse_event

msvcp140

?_BADOFF@std@@3_JB

urlmon

URLOpenBlockingStreamA

d3dx9_43

D3DXCreateLine

d3d9

Direct3DCreate9

vcruntime140

memset

api-ms-win-crt-stdio-l1-1-0

fputc

api-ms-win-crt-runtime-l1-1-0

_cexit

api-ms-win-crt-filesystem-l1-1-0

_lock_file

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-time-l1-1-0

clock

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-math-l1-1-0

_except1

Sections

.MPRESS1
Size: 33KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 472B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE