b0ab23e05976146602b5d9dfa181615f | Triage

Sharing

General

Target

b0ab23e05976146602b5d9dfa181615f
Size

223KB
MD5

b0ab23e05976146602b5d9dfa181615f
SHA1

191d7eb1a8a3af232e3cde3369daf1a6d47a8cca
SHA256

af1033cc74915b03343d07d330325d80b6cc2f8fac0d5c31de65f8741f7cf755
SHA512

4bc188fe262ff1a9f028cdce90ab5605fe4e3f698206e566d209ab60c639691fcf01b4cb36ccf3c1f1fd96a2611c84c32931644a8dd4dea54eb79bc0c8f95a36
SSDEEP

6144:wXTPLOrTxZprQFLlCHcy3u/cEcZxKcRIZhjHtJaDe8Y:os5QlMtZ2NJi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b0ab23e05976146602b5d9dfa181615f

Files

b0ab23e05976146602b5d9dfa181615f
.dll windows:6 windows x86 arch:x86

1f6199c52a5d3ffac2a25f6b3601dd22

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

qsort
bsearch

kernel32

VirtualProtect
IsBadReadPtr
LoadLibraryW
SetLastError
HeapAlloc
HeapFree
GetProcessHeap
VirtualAlloc
VirtualFree
VirtualQuery
FreeLibrary
GetProcAddress
LoadLibraryExA
LoadLibraryA

Sections

.text
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 215KB - Virtual size: 216KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ