0e20e1fdc59d5af880432f77512048de | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0e20e1fdc59d5af880432f77512048de
Size

24KB
MD5

0e20e1fdc59d5af880432f77512048de
SHA1

76935e184596050a472055bbfdeda0569bc30752
SHA256

8ac19fed5e195f8e399551231239c4f9cb29e612a95745829b735d4a4e309860
SHA512

c799d817888305daa639ffb8e8242f29568c91cc83f7eb3adcd2901ae35b5dbdd0fcfa4465f5f2ae7ba547c8eaebdb5b13870e7f2cef020f4fceb8234e14561a
SSDEEP

192:Asl9aHrfKacBA+A8Xt7TOELtdRp1K9I949ygE6LntXpct5UTIZ3a:hIrfam+A8XtvlLro8sygDntXpct5GIY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0e20e1fdc59d5af880432f77512048de

Files

0e20e1fdc59d5af880432f77512048de
.dll windows:4 windows x86 arch:x86

5c1f4eb16e8a7cd08d53b16fab816511

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

GetClassNameA
GetWindowThreadProcessId
EnumWindows
EnumChildWindows
GetWindowTextA
SetWindowTextA

msvcrt

free
strchr
malloc
_adjust_fdiv
_strupr
atoi
memcpy
strcmp
strstr
fopen
fwrite
fclose
fread
time
memset
??2@YAPAXI@Z
??3@YAXPAX@Z
_strlwr
_itoa
_initterm

kernel32

Sleep
CopyFileA
GetProcAddress
ExitProcess
GetCommandLineA
lstrcmpA
GetModuleFileNameA
CreateThread
GetTempPathA
lstrlenA
lstrcpyA
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory
LoadLibraryA

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 890B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ