0a08aa118faccb6fae70a2b9d2e8cce9 | Triage

Sharing

General

Target

0a08aa118faccb6fae70a2b9d2e8cce9
Size

16KB
MD5

0a08aa118faccb6fae70a2b9d2e8cce9
SHA1

d448151d72b1c4b010b0aa2058aaacad91f09b10
SHA256

65799684911366ee0f7e8d015a59faaa7409cc8803afcb5bee06a23eb3c70620
SHA512

a85e02b5b07819e594854f589767ae24c48837818b5f611842f7ab166065dfc726ce2e9d1256540f8795d87873b7b65476b80ef605f007761e79e53d18f06479
SSDEEP

384:Zs9yDxjLn8UuJ5K8XHrYFLstrCztWVhQehzzVSETyEO:0uxHr85NbYFg8EvltYq+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0a08aa118faccb6fae70a2b9d2e8cce9

Files

0a08aa118faccb6fae70a2b9d2e8cce9
.dll regsvr32 windows:4 windows x64 arch:x64

9c0432e1910a7f6b5d39ec1826872d5a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateThread
GetProcessHeap
GetTickCount
HeapAlloc
HeapFree
HeapReAlloc
Sleep

Exports

Exports

Control
DllRegisterServer
DoNothing
FreeBuffer
Release
Start
StartW

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 478B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ