4f16567c5e537c31265a4a6a95eb16f2 | Triage

Sharing

General

Target

4f16567c5e537c31265a4a6a95eb16f2
Size

24KB
MD5

4f16567c5e537c31265a4a6a95eb16f2
SHA1

f5615e598bc42c96c1f26950d1c4e13ab0173632
SHA256

eb002ce3636edbbc32f00aaad208f265f31f63744cb8cdcf6f880f52558c1597
SHA512

5441f53dcdecc215f81e622a2c0692beb0e5611afe1277347038ce8a38c4864a185c1882d320cb0b1029f0a8643304651daa0d9dc0a02c61452c11fc9886085f
SSDEEP

96:q/g+AFPQh0zzYM3q4q5dbV+GTMIOSZzuC0jps:qo+6PYM3qXnBTFOSZzY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4f16567c5e537c31265a4a6a95eb16f2

Files

4f16567c5e537c31265a4a6a95eb16f2
.dll windows:4 windows x86 arch:x86

b563f68818a8b80333b04f130dafcc67

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord2818
ord1176
ord1575
ord1168
ord1577
ord1182
ord2614
ord1243
ord1197
ord1570
ord1253
ord1255
ord6467
ord1578
ord860
ord858
ord800
ord342
ord540
ord600
ord826
ord1116
ord269

msvcrt

??1type_info@@UAE@XZ
_mbscmp
__CxxFrameHandler
??2@YAPAXI@Z
__dllonexit
_onexit
free
_initterm
malloc
_adjust_fdiv
??3@YAXPAX@Z
sprintf

kernel32

LocalFree
OpenProcess
GetModuleHandleA
LocalAlloc

user32

CallNextHookEx
SendMessageA
FindWindowExA
GetWindowTextA
GetClassNameA
GetWindow
UnhookWindowsHookEx
GetWindowThreadProcessId
SetWindowsHookExA
FindWindowA
EnumChildWindows

Exports

Exports

sethook
unhook

Sections

.text
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

MySec
Size: 4KB - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ