6430865105df5387ffcba282dc75f8bf | Triage

Sharing

General

Target

6430865105df5387ffcba282dc75f8bf
Size

17KB
MD5

6430865105df5387ffcba282dc75f8bf
SHA1

bbe88feff3586f087394d9d12fa2e31f7537280a
SHA256

71f16879164b5f879efa617da519430b10d78c4be9bea7278d347fad034cb6a4
SHA512

7e4df021c60b75055f6e8e75c0d7551e773a8f9654842cd691ef21e59d8151b611832701c1b859f2cfd0b29f8c041c52e225893147f79edce8fe64c5fb1f54a4
SSDEEP

384:CN45bw3ny8YblNHj3XtMER9kU3h8QoEvotWf:CN45k3yDlNTSER95hT6tWf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6430865105df5387ffcba282dc75f8bf

Files

6430865105df5387ffcba282dc75f8bf
.dll windows:4 windows x86 arch:x86

96144bcb540c1762865355eaf17e3c78

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetSystemDirectoryA
GetCurrentProcessId
FreeLibrary
GetTempPathA
GetWindowsDirectoryA
CreateMutexA
lstrcatA
CreateThread
DisableThreadLibraryCalls
GetCurrentProcess
LoadLibraryA
ExitProcess
Sleep
GetProcAddress

user32

GetForegroundWindow
FindWindowExA
PostMessageA
GetWindowTextA
keybd_event
MessageBoxA
wsprintfA

advapi32

LookupPrivilegeValueA
DeleteService

msvcrt

fclose
fopen
??2@YAPAXI@Z
fscanf
printf

Exports

Exports

CompareLinkInfoReferents
CompareLinkInfoVolumes
CreateLinkInfo
CreateLinkInfoA
CreateLinkInfoW
DestroyLinkInfo
DisconnectLinkInfo
GetCanonicalPathInfo
GetCanonicalPathInfoA
GetCanonicalPathInfoW
GetLinkInfoData
IsValidLinkInfo
ResolveLinkInfo
ResolveLinkInfoA
ResolveLinkInfoW
Rsll

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 810B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ