279bc11585e1d8ba1b56f14da28acf4c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

279bc11585e1d8ba1b56f14da28acf4c
Size

67KB
MD5

279bc11585e1d8ba1b56f14da28acf4c
SHA1

622a83ed96d6090a6f5d84b236c1f67f9c52a7ca
SHA256

39d775f08b8c7263ec3875118ce8701381e0b782f9c0b2518c2e5cc8c42b9512
SHA512

f6a2276da42c77ac5587bac981adc867c8d105bbce62a0e8e27c317bf7a3110bd27ba473d8f43743913bf289cee545e2268339520e4ce49190c2e73a50bb114a
SSDEEP

1536:BfQAl+7ovOMwmLPFouwIk4hCWVlYGOv3BoP627LaPCW6z/Cqwag3:dQAl+pMwmLPFTNHLFPF7LgiX4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
279bc11585e1d8ba1b56f14da28acf4c

Files

279bc11585e1d8ba1b56f14da28acf4c
.dll windows:4 windows x86 arch:x86

d789bbd14d9363f075bb8a0efcaa628b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

msvcrt

time

user32

UnhookWindowsHookEx

advapi32

RegQueryValueExA

Exports

Exports

CancelDll
LoadDll

Sections

.text
Size: 8KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE