648847cb3ad6afdf6d3a90c90cdfc4e5 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

648847cb3ad6afdf6d3a90c90cdfc4e5
Size

16KB
MD5

648847cb3ad6afdf6d3a90c90cdfc4e5
SHA1

62b313075ed6a03f4d9acd4eeb56eb809b65bd97
SHA256

c1bc93636e532d06160d1d68363966fd798c905f993608a2bb7396ebf9a88a40
SHA512

19fc3a9e8de3b3df9d12b1a0cd164f941272367fb698c7028e7ee4bc7ee58d423ed2732ceaeec74ed031b5c83015afa659101453ba0536fd6fabb95d88baf7a0
SSDEEP

192:OyDXkHvY/bAerTaEa9cRkjXeApSS5DFJifONhYdShQWScQxhW9etvsCSX:TDU1mja9cOuS5cvhWKxhWEtmX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
648847cb3ad6afdf6d3a90c90cdfc4e5

Files

648847cb3ad6afdf6d3a90c90cdfc4e5
.dll windows:4 windows x86 arch:x86

3c8e5584df553adb098a5d5b58362644

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateFileA
GetLastError
CreateMutexA
GetCurrentProcessId
GetFileSize
SetFilePointer
VirtualProtect
ReadFile
HeapAlloc
GetProcAddress
LoadLibraryA
GetModuleHandleA
CloseHandle
GetCurrentProcess
TerminateProcess
Sleep
GetModuleFileNameA
GetProcessHeap
CreateThread

msvcrt

??3@YAXPAX@Z
??2@YAPAXI@Z
__CxxFrameHandler
memcpy
_except_handler3
strstr
fclose
fopen
_vsnprintf
__dllonexit
_onexit
_initterm
_adjust_fdiv
_strcmpi
strrchr
strcat
strncpy
strlen
memset
free
malloc

user32

wsprintfA

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ