297628460f5026075895c7564af3f9ca | Triage

Sharing

General

Target

297628460f5026075895c7564af3f9ca
Size

116KB
MD5

297628460f5026075895c7564af3f9ca
SHA1

ae6064fcc0b0f9439e4ae48f2986e31c6712b609
SHA256

2cfc82686fa120bedd7d3646b315729c6c2e82c8bbcecfb4dcbf6158809692cc
SHA512

1bcb1de91fdd8eb63945606ec88519b8e86835e70d7e235748b7f62e29dd43f195d1c3e5c27cc760dc61a87a96879d828257cfb779c405a38205b51e4c74d296
SSDEEP

3072:Qa2b4n7/hgYHvqc1VbdDgnoL1U7vPWgLCU5ff/k:QlbYrXHvfcvPWgLCU5f

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
297628460f5026075895c7564af3f9ca

Files

297628460f5026075895c7564af3f9ca
.dll windows:1 windows x86 arch:x86

c5070bbe77db5ababb4e9b81e8d0811c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
CreateFileW
ExitProcess
ExpandEnvironmentStringsW
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnvironmentVariableW
GetLastError
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
GetSystemTimeAsFileTime
GetTickCount
InterlockedCompareExchange
InterlockedExchange
IsDebuggerPresent
LoadLibraryExW
MultiByteToWideChar
QueryPerformanceCounter
ReadFile
SetEnvironmentVariableW
SetUnhandledExceptionFilter
Sleep
TerminateProcess
UnhandledExceptionFilter
WideCharToMultiByte

Exports

Exports

CreateProcessNotify

Sections

.text
Size: 113KB - Virtual size: 113KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 1024B - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 81B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 14B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ