31a107c4699d1448fb56da236f009fe9 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

31a107c4699d1448fb56da236f009fe9
Size

3KB
MD5

31a107c4699d1448fb56da236f009fe9
SHA1

c1190492d5c82e63cb01925aecb0de3013cd6471
SHA256

80bcf3bae6580dcb92b90a7bd7b180072a001e64c3a6847426470f5ebec19858
SHA512

fced1a320624102af10a2e2f3f618c72ca4de15e449d4810c3a5dc2f3283ad1aea845f417763be4cc4332bbb8ee4fd27ab950c8dbbcb5845a235c66aeb8adfc2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
31a107c4699d1448fb56da236f009fe9

Files

31a107c4699d1448fb56da236f009fe9
.dll windows:4 windows x86 arch:x86

5d67ca2286452ee6c1a6d95cd09ea0b2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcessHeap
Sleep
GetLastError
lstrcmpiW
CreateMutexA
CloseHandle
CreateThread
HeapFree
lstrcpynW
GetProcAddress
VirtualAlloc
GetModuleHandleA
VirtualProtect
WriteProcessMemory
GetCurrentProcess
HeapAlloc
ReadProcessMemory

user32

SetWindowsHookExA
CallNextHookEx

advapi32

LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ