2882a938c893ab2d4d30beee33b0da4a | Triage

Sharing

General

Target

2882a938c893ab2d4d30beee33b0da4a
Size

17KB
MD5

2882a938c893ab2d4d30beee33b0da4a
SHA1

a81c3899fa72ad3e9c5f2faaa9d22873edafc530
SHA256

cb695f297a20242fbf9735e140ae7b2bec7384ade7b065b771aefbda2b283da6
SHA512

4c68fca040ba9b1035a44c404219a0459a946af10a982b5ca38e543821f38bbe24a76d91a861353632a3a3c5917ccb71d22dd76a861ebee3a2e83be96cc8b547
SSDEEP

384:CN45bw3ny8YblNHj3XtMER9kU3h8QoEvotPL:CN45k3yDlNTSER95hT6tPL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2882a938c893ab2d4d30beee33b0da4a

Files

2882a938c893ab2d4d30beee33b0da4a
.dll windows:4 windows x86 arch:x86

96144bcb540c1762865355eaf17e3c78

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetSystemDirectoryA
GetCurrentProcessId
FreeLibrary
GetTempPathA
GetWindowsDirectoryA
CreateMutexA
lstrcatA
CreateThread
DisableThreadLibraryCalls
GetCurrentProcess
LoadLibraryA
ExitProcess
Sleep
GetProcAddress

user32

GetForegroundWindow
FindWindowExA
PostMessageA
GetWindowTextA
keybd_event
MessageBoxA
wsprintfA

advapi32

LookupPrivilegeValueA
DeleteService

msvcrt

fclose
fopen
??2@YAPAXI@Z
fscanf
printf

Exports

Exports

CompareLinkInfoReferents
CompareLinkInfoVolumes
CreateLinkInfo
CreateLinkInfoA
CreateLinkInfoW
DestroyLinkInfo
DisconnectLinkInfo
GetCanonicalPathInfo
GetCanonicalPathInfoA
GetCanonicalPathInfoW
GetLinkInfoData
IsValidLinkInfo
ResolveLinkInfo
ResolveLinkInfoA
ResolveLinkInfoW
Rsll

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 810B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ