56d5964848dbd5ae9339e61e4f51ae31 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

56d5964848dbd5ae9339e61e4f51ae31
Size

11KB
MD5

56d5964848dbd5ae9339e61e4f51ae31
SHA1

92e59b4bfbd5f01a7b25187ff7510931bb263a45
SHA256

bdd98df204f154b04a7c6e9a1adbca52c37031119f309d19abfd986d22f2a3a6
SHA512

628807e22ea2851c629d8454fcc83e3b2ba7f575c9fca3c58dcf4bf84db6081aed911291b06073a3a8909532f5972fb91556a25d13aa368ad084291b4a18ce8e
SSDEEP

192:vIpWHWo+YgnIwq0/G0SJZRhl3KQFi/7BI+Ce9RFFke:eWHWo+Iwq0/sbhlaQS7hCk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
56d5964848dbd5ae9339e61e4f51ae31

Files

56d5964848dbd5ae9339e61e4f51ae31
.dll windows:4 windows x86 arch:x86

601187eeed4acc60a987c53e8c0e62c1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

socket
connect
bind
recvfrom
listen
accept
WSAStartup
gethostbyname
send
htons
sendto
closesocket
select
__WSAFDIsSet
recv

wininet

InternetConnectA
InternetGetConnectedStateEx
InternetOpenA
InternetOpenUrlA
InternetCloseHandle
InternetReadFile
FtpPutFileA

urlmon

URLDownloadToFileA

kernel32

WinExec
GetWindowsDirectoryA
lstrcatA
CreateThread
Sleep
lstrcmpA
lstrlenA
lstrcpyA
GlobalFree
CreateFileA
ReadFile
SetFilePointer
WriteFile
CloseHandle
GetFileSize
GlobalAlloc

user32

CharLowerBuffA

advapi32

RegQueryInfoKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ