52b42b357d8dfaf91424599b108fa121 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

52b42b357d8dfaf91424599b108fa121
Size

17KB
MD5

52b42b357d8dfaf91424599b108fa121
SHA1

8b909e8492cd4b52e9b6ba712ed2494fb496261e
SHA256

8f7ba8ab9954f0873d8504841b2fd45abbf87dcbe6fcba1552db7e371a760d08
SHA512

e83051c11f210fe1eb63a190428b44ebcaf35e5c690219ba4d60809de3731c13e1ad4b4b2ede0d654de77f23a0baa9d652bee34c2a563063c2fd3ed03c01345e
SSDEEP

384:cCN4oh6u8yCU1vRAMGXCDHjO5QGhddq2Bzq4W9fW3:NN4oh6LnEelt7EE2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
52b42b357d8dfaf91424599b108fa121

Files

52b42b357d8dfaf91424599b108fa121
.dll windows:4 windows x86 arch:x86

9260fe964e5a68fd7603e0ba6c85f6f3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcatA
GetSystemDirectoryA
FreeLibrary
GetTempPathA
GetWindowsDirectoryA
CreateMutexA
GetCurrentProcessId
LoadLibraryA
DisableThreadLibraryCalls
GetCurrentProcess
Sleep
ExitProcess
CreateThread
GetProcAddress

user32

GetWindowTextA
GetForegroundWindow
FindWindowExA
wsprintfA
keybd_event
PostMessageA

advapi32

LookupPrivilegeValueA

msvcrt

fopen
printf
fscanf
fclose
??2@YAPAXI@Z

Exports

Exports

CompareLinkInfoReferents
CompareLinkInfoVolumes
CreateLinkInfo
CreateLinkInfoA
CreateLinkInfoW
DestroyLinkInfo
DisconnectLinkInfo
GetCanonicalPathInfo
GetCanonicalPathInfoA
GetCanonicalPathInfoW
GetLinkInfoData
IsValidLinkInfo
MSCON
ResolveLinkInfo
ResolveLinkInfoA
ResolveLinkInfoW

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 802B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ