123321[.]vbs | Triage

Sharing

General

Target

123321.vbs
Size

1.8MB
MD5

e5e48e4619d951e0dd6d7bfd613bb109
SHA1

308a7cb97bf20596adc697107c7a89fb34bb7224
SHA256

8ed71986b28af6facf58d6d47d1190459d95427d0b0d92f32b25de3cd0755f2c
SHA512

5987f4864c86b045142f990b2d75343204c567b17c635e266e48682878eb1f59df041e02a9606254115a1ca8ecd170f7644d16df55727953317651eb0e10d2e7
SSDEEP

24576:FSfBk+9Zl7pC4HE+Y/lU/Z46vVJkWuQpJ53am1u46FxVDmdVxoejIF4UAVddHctD:6kFhgJ8m1u/CVxodFSfd+WC9J

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
123321.vbs

Files

123321.vbs
.dll windows:6 windows x86

244d8f9f2c625c07accc7836974657c1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetProcessHeap
CloseHandle
GetComputerNameA
GetLastError
HeapWalk
HeapCreate
TryEnterCriticalSection
CreateActCtxA
ActivateActCtx
CreateThread
GetCurrentProcessId
WaitForSingleObject
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
VirtualAlloc
HeapLock

Exports

Exports

DeR8
HUF_inc_var
ITbi4
ObrRM2679
OdAgP61
YiRgp93sN0

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 787KB - Virtual size: 787KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ