55e22a9799a68b1a0aac456305123929 | Triage

Sharing

General

Target

55e22a9799a68b1a0aac456305123929
Size

24KB
MD5

55e22a9799a68b1a0aac456305123929
SHA1

0078aa61ab4ecf0d196631b9b2b6f53ccc9ea657
SHA256

13ac92b73dabdad5d2ffd4c966ddf769a881b65be05c21a257646c271f8116d0
SHA512

8db79c5dfe6090f7b566a67c023cc9068c024e4d9d92d3b6c642401240fb25ed38a73d93f46e9686bb23fbfa77ae6b057afb21ee0a5047ca1467d43720c1a44e
SSDEEP

192:VlmS9xWaWvd+YlSSDQ2sqImrcjjiWS1MhNP1TRU:VlmcWNd+YlSSDBsqITjeWS1MhNPU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
55e22a9799a68b1a0aac456305123929

Files

55e22a9799a68b1a0aac456305123929
.dll windows:4 windows x86 arch:x86

07c095844c9a2f82f2e0746d6c3e8196

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

TerminateProcess
OutputDebugStringA
Sleep
DisableThreadLibraryCalls
CreateProcessA
GetLastError

user32

EnumChildWindows
SendMessageA
GetParent
CloseDesktop
GetClassNameA
EnumDesktopWindows
PostMessageA
CreateDesktopA
OpenDesktopA
SetForegroundWindow
GetWindowThreadProcessId

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

shell32

SHGetSpecialFolderPathA

ws2_32

WSAStartup
connect
socket
htons
send
recv
closesocket
shutdown
inet_addr
WSACleanup
gethostbyname
setsockopt

msvcrt

_adjust_fdiv
_initterm
time
srand
atoi
strchr
rand
realloc
sprintf
malloc
strstr
free

Exports

Exports

GetDLlVersion
Run
Sunbelt

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 704B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 790B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ