e46638104be5781ab5d08c0d5017068846b7cbe62c597923f5f581fea8f0fbbe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e46638104be5781ab5d08c0d5017068846b7cbe62c597923f5f581fea8f0fbbe
Size

512KB
MD5

ea1e4ba46f2d95b1a5018870bb555173
SHA1

4095a5d591e4903810f3c5e7ef3b4491032ab625
SHA256

e46638104be5781ab5d08c0d5017068846b7cbe62c597923f5f581fea8f0fbbe
SHA512

2ba6304a3d23f15c161e7ab9a6160e63b8058ca44f70b9ca416d8144ed5071ae3feabcde670a5d1e36c400c1758485f788ab66f65aeb5988a3b74ca9547fcd7d
SSDEEP

12288:lzj3uIKQLR7SQaD89gCFfLfR6xjYhcmmIBJ3ZFt:lzj3uIKQ4D89gILJ6xfmZBvn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e46638104be5781ab5d08c0d5017068846b7cbe62c597923f5f581fea8f0fbbe

Files

e46638104be5781ab5d08c0d5017068846b7cbe62c597923f5f581fea8f0fbbe
.dll windows:4 windows x86

823923e8ca7666456f302c50d232fb85

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

winmm

midiStreamClose

ws2_32

closesocket

rasapi32

RasHangUpA

user32

GetClassNameA

gdi32

ExtSelectClipRgn

winspool.drv

OpenPrinterA

advapi32

RegCloseKey

shell32

Shell_NotifyIconA

ole32

OleInitialize

oleaut32

UnRegisterTypeLi

comctl32

ord17

wininet

InternetCanonicalizeUrlA

comdlg32

GetSaveFileNameA

Exports

Exports

CInit
CUnInit
_��ڴ��е�DLL
_ȡ�ڴ�DLL��ַ

Sections

.text
Size: 499KB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE