558780d39174005e62a80959f8920346 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

558780d39174005e62a80959f8920346
Size

157KB
MD5

558780d39174005e62a80959f8920346
SHA1

bb8d73c14358b070bd53de45aa7dadf3522f153e
SHA256

d00b325f66af81b5797da7385b4942ba5e1ea3cdb6b856cbe0e87e6f7bcbcb2f
SHA512

5e24800b632d3ef204e26e1d5df595b067e28fa121969b5c3651be0c8ca3e313a37af42ce973425ead7f97488b433cdbdab0357afe4bd29dc5f65a830ad87cea
SSDEEP

3072:GxDTjlL17dI42dMuSSOAMRfPg/l4Dy9SgRcArzS1BFAMwJ+0SsxFkq72qLdj2cdz:GxDTN17dINU79G4yEgRcAfS5AMwJNH3M

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
558780d39174005e62a80959f8920346

Files

558780d39174005e62a80959f8920346
.dll windows:5 windows x86 arch:x86

386a449829cf2038bf2643d937d8f0a9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

??2@YAPAXI@Z
wcscat
wcscpy
malloc
_except_handler3
?terminate@@YAXXZ
__CxxFrameHandler
free
??3@YAXPAX@Z
wcsrchr
memmove
wcslen

ntdll

NtQueryInformationFile
RtlNtStatusToDosError
NtSetInformationFile

rpcrt4

RpcStringFreeW
UuidToStringW
UuidFromStringW

kernel32

ReadFile
SetEndOfFile
GetFileAttributesW
SetFileAttributesW
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetLastError
GetDiskFreeSpaceW
InitializeCriticalSection
SetFilePointer
WriteFile
CreateFileW
DeviceIoControl
CloseHandle
GetLastError

Exports

Exports

SisCSFilesToBackupForLink
SisCreateBackupStructure
SisCreateRestoreStructure
SisFreeAllocatedMemory
SisFreeBackupStructure
SisFreeRestoreStructure
SisRestoredCommonStoreFile
SisRestoredLink

Sections

.text
Size: 154KB - Virtual size: 154KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 472B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ