61f924f9d61f6834715a72dd9d200593 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

61f924f9d61f6834715a72dd9d200593
Size

210KB
MD5

61f924f9d61f6834715a72dd9d200593
SHA1

1405fa47350ae897c6a96cc74050aa9a8c9c2350
SHA256

e4d6fb0aac673dccc30983ea8fb65f16dd5a311d24c544ffc716273796cf403f
SHA512

aa2b754167a03fa5ed02a7e0cd059a8f62c0dbcf0abc6ba4cc42fca6d612e1292e992a68d9068835f67be9cff193996f4da6b2ffbc4bf674516ccea75eca959a
SSDEEP

6144:stT8wwnTBdRI5VRAeILlid5k4lk2Dpdyevw759g9:stT8rnTHRIDK/Enk4lPzvw/g9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
61f924f9d61f6834715a72dd9d200593

Files

61f924f9d61f6834715a72dd9d200593
.dll windows:4 windows x86 arch:x86

0a522a80b54f8b4c66c9b48f13df8291

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

nscrt

malloc
free
_adjust_fdiv
__CppXcptFilter
_except_handler3
__dllonexit
_onexit
_initterm

kernel32

DisableThreadLibraryCalls

Exports

Exports

adler32
adler32_combine
compress
compress2
compressBound
crc32
crc32_combine
deflate
deflateBound
deflateCopy
deflateEnd
deflateInit2_
deflateInit_
deflateParams
deflatePrime
deflateReset
deflateSetDictionary
deflateSetHeader
deflateTune
get_crc_table
inflate
inflateCopy
inflateEnd
inflateGetHeader
inflateInit2_
inflateInit_
inflatePrime
inflateReset
inflateSetDictionary
inflateSync
inflateSyncPoint
uncompress
zError
zlibCompileFlags
zlibVersion

Sections

.text
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 704B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ