5e0d6320c0df3029995d46f7c5ad0b8c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5e0d6320c0df3029995d46f7c5ad0b8c
Size

239KB
MD5

5e0d6320c0df3029995d46f7c5ad0b8c
SHA1

8787ad4d3dd7a0aec79e953fdcc3904d27855276
SHA256

1273f905990b6d0935a4cf7e0e46a15321f1239432c7b101071bf1d69701bf3f
SHA512

a181cbdc2fd4e94499649489ebaa20603343cc70e2becbc0c3bd181d676ca1ad72ecc4694cfec24d4d359e9ddfa54e96bdd9c022216fec30b1b6c35ba51ad771
SSDEEP

6144:RuC904rdC93yDeqyEIH4Q1xNL66Z9M44e:RLm4ZA1quljF9M44e

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5e0d6320c0df3029995d46f7c5ad0b8c

Files

5e0d6320c0df3029995d46f7c5ad0b8c
.dll windows:4 windows x86 arch:x86

09d0478591d4f788cb3e5ea416c25237

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

Exports

Exports

CreateMainProc
CreateProtectProc
DllCanUnloadNow
DllGetClassObject
InitSecurityInterfaceW
LsaApCallPackage
LsaApCallPackagePassthrough
LsaApCallPackageUntrusted
LsaApInitializePackage
LsaApLogonTerminated
LsaApLogonUser
LsaApLogonUserEx
RealLogoff
RealLogon
SpInitialize
Startup

Sections

.text
Size: 208KB - Virtual size: 600KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE