79c42c1cd0c4a1a91ba270a92a9cad63 | Triage

Sharing

General

Target

79c42c1cd0c4a1a91ba270a92a9cad63
Size

115KB
MD5

79c42c1cd0c4a1a91ba270a92a9cad63
SHA1

4d8ad17d3bb2ef3b51e2a887499ed5ea040bdda3
SHA256

6838f818e9244445530f51df05a9f26f0a3758f58fc45c9d5d22223808cc8120
SHA512

bb9e6e894443b9940c76f34f24a861b32ae4d4c74afa742f8ce59bd7cbec8a2803177d5e3ed9a22c036002d864f416182bb970a51ec22f4288a38948995cffe5
SSDEEP

1536:sjkkJP0df45rr04ZSCB3quf06F/xRjvlZagwM3HD:sIkJP0df45rIaB06FphvlZagf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
79c42c1cd0c4a1a91ba270a92a9cad63

Files

79c42c1cd0c4a1a91ba270a92a9cad63
.dll windows:4 windows x86 arch:x86

c2dd8b2417c47c04976d15f19f79dc5b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

Beep
HeapReAlloc
HeapDestroy
OpenEventW
FindResourceExW
FindResourceW
SetLastError
HeapAlloc
GetProcessHeap
HeapFree
OpenSemaphoreA

rpcrt4

RpcStringBindingParseW
RpcBindingVectorFree
RpcBindingToStringBindingW
RpcEpUnregister
RpcEpRegisterW
RpcServerListen
RpcServerRegisterIfEx
RpcServerRegisterAuthInfoW
RpcServerInqDefaultPrincNameW
RpcImpersonateClient
RpcRevertToSelfEx
UuidFromStringW
NdrAsyncServerCall
NdrServerCall2
RpcStringFreeW
RpcServerInqBindings
RpcServerUseProtseqW
RpcAsyncCompleteCall
UuidCreate
UuidToStringW
RpcMgmtStopServerListening
RpcAsyncAbortCall

Sections

.text
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrh
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 430B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ