191b21cf08b32229acae7fa15ad8c659 | Triage

Sharing

General

Target

191b21cf08b32229acae7fa15ad8c659
Size

74KB
MD5

191b21cf08b32229acae7fa15ad8c659
SHA1

8f3107e260211af1af93cbc58fe201b47a131849
SHA256

e0e345e077637ad607146b0b9efa39582bbcbb8c9d155e46d3d39038b0704b06
SHA512

b80e193db9fa24ef961aa0539c03472d83064904ad3cc7d692be6e237dd10e90beaf07ed7c900e7c717badfc9339d4bbd3ccac20adf385076a6861fc31b25726
SSDEEP

768:HHV2l2FCB5rJ8XMneNHV2l2FCB5rJ8XMneNHV2l2FCB5rJ8XMneNHV2l2FCB5rJy:V2lT08ne2lT08ne2lT08ne2lT08n

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
191b21cf08b32229acae7fa15ad8c659

Files

191b21cf08b32229acae7fa15ad8c659
.dll windows:4 windows x86 arch:x86

39d68b638b5d06d9e6c417e783471a93

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

GetForegroundWindow
GetClassNameA
wsprintfA

kernel32

lstrlenA
CloseHandle
CreateFileA
CreateThread
DisableThreadLibraryCalls
GetCurrentProcess
GetModuleFileNameA
GetPrivateProfileStringA
GetProcAddress
GetWindowsDirectoryA
GlobalAlloc
LoadLibraryA
MultiByteToWideChar
ReadFile
ReadProcessMemory
RtlMoveMemory
RtlZeroMemory
SetFileAttributesA
SetFilePointer
Sleep
TerminateProcess
VirtualProtectEx
WideCharToMultiByte
lstrcatA
lstrcmpA
lstrcmpiA
lstrcpyA

advapi32

RegQueryValueExA

Exports

Exports

EnHookWindow
UninstallHook
sub_getmessage
sub_keyboard
sub_mouse

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 12B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ