625419cf8ff8d950f0fefc9d82c17bcb | Triage

Sharing

Copy URL Twitter E-mail

General

Target

625419cf8ff8d950f0fefc9d82c17bcb
Size

44KB
MD5

625419cf8ff8d950f0fefc9d82c17bcb
SHA1

291df19f60ad0a738a4e3e6683454799e18c71ab
SHA256

d477a1c96ac91ed8f7662ed99ad6c77ca6b2d0cadcc03d0c33faeda73695049f
SHA512

5e8f1d9b04cbedddb97325915cf387b8a619512ec73e435a8fee5c5d21dd0f2591a198e6ca3b84ed0109a313c20cf237439c1bbebed50dd0609401cb49100a97
SSDEEP

768:MibGZAeby9kzbps9G56GJbD1ra7gV2i6VGQmuC4elLKa9zYstxKt5:q9ymwAuo2i6VG+CtLdzYsfKj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
625419cf8ff8d950f0fefc9d82c17bcb

Files

625419cf8ff8d950f0fefc9d82c17bcb
.dll windows:4 windows x86 arch:x86

44613e009b7ec4576c3a53032384c98f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

ole32

CreateStreamOnHGlobal

psapi

GetModuleFileNameExA

avicap32

capCreateCaptureWindowA

winmm

waveInUnprepareHeader

shell32

ShellExecuteA

shlwapi

StrCmpW

imm32

ImmReleaseContext

msvcrt.dll

malloc

user32

ExitWindowsEx

ws2_32

listen

gdi32

DeleteObject

advapi32

RegCloseKey

Exports

Exports

gytfredwse
ServiceMain
qwaszxerd

Sections

.erdf
Size: 25KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

edrft
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

rtyhgj
Size: 3KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE