0a783b672837a273f8565113ca32fd13 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0a783b672837a273f8565113ca32fd13
Size

17KB
MD5

0a783b672837a273f8565113ca32fd13
SHA1

fc2f6c0edcf92ad2b15e8585e023b23b79dbcaae
SHA256

38d7eb7c15b2bec4a360f05b2f1b0b4e804acf84087acd6995eae0aeaefce1f3
SHA512

cc6626d1b0c859ec9c6ae36a7ea84126f2e0cb80ccac1a6fee0cab735a3f7c481845a751db0f5f364f885822acb473dad8e9edea03c0abf8f0aa9d3f507dc805
SSDEEP

384:3N4rxdg838Y2Pb3Dcb3Ghddu5g3KQo3+Ky0:3N4rxL+Ub27Ig35r/0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0a783b672837a273f8565113ca32fd13

Files

0a783b672837a273f8565113ca32fd13
.dll windows:4 windows x86 arch:x86

00cd8b0fcd86082f590a23d0ecf418f4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetSystemDirectoryA
GetCurrentProcessId
FreeLibrary
GetTempPathA
GetWindowsDirectoryA
CreateMutexA
lstrcatA
CreateThread
DisableThreadLibraryCalls
GetCurrentProcess
LoadLibraryA
ExitProcess
Sleep
GetProcAddress

user32

GetWindowTextA
PostMessageA
GetForegroundWindow
wsprintfA
keybd_event
FindWindowExA

advapi32

DeleteService
LookupPrivilegeValueA

msvcrt

fopen
printf
fscanf
fclose
??2@YAPAXI@Z

Exports

Exports

CRT
CompareLinkInfoReferents
CompareLinkInfoVolumes
CreateLinkInfo
CreateLinkInfoA
CreateLinkInfoW
DestroyLinkInfo
DisconnectLinkInfo
GetCanonicalPathInfo
GetCanonicalPathInfoA
GetCanonicalPathInfoW
GetLinkInfoData
IsValidLinkInfo
ResolveLinkInfo
ResolveLinkInfoA
ResolveLinkInfoW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 794B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ