fb7e7e2cf2c7fb6ca2791051705c6b62 | Triage

Sharing

General

Target

fb7e7e2cf2c7fb6ca2791051705c6b62
Size

17KB
MD5

fb7e7e2cf2c7fb6ca2791051705c6b62
SHA1

55f11e02f9b75534e9ae0c90bc0b29cb1ba6a677
SHA256

eb051fa7faa78b2c438f6550201696fbcfbf950f2c0ac15cdfe64e9a9a4a64bb
SHA512

3994d2e6650bb4a3e1f65a06a16307d7d1ff37fd3bc4eed967568ba26dfb200477d0236d748e9bdc64085e8ffb466a867cfc453bae8dae30a313dc7eef814d81
SSDEEP

384:NN4CxtwaP38YKfb3xB6GhddRQmhqW9fWhH:NN4CtwSC/x7MA+H

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fb7e7e2cf2c7fb6ca2791051705c6b62

Files

fb7e7e2cf2c7fb6ca2791051705c6b62
.dll windows:4 windows x86 arch:x86

707eaf3c018c78475e6a64d80574894d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetSystemDirectoryA
GetCurrentProcessId
FreeLibrary
GetTempPathA
GetWindowsDirectoryA
CreateMutexA
lstrcatA
DisableThreadLibraryCalls
GetCurrentProcess
Sleep
LoadLibraryA
ExitProcess
CreateThread
GetProcAddress

user32

GetWindowTextA
PostMessageA
GetForegroundWindow
wsprintfA
keybd_event
FindWindowExA

advapi32

DeleteService
LookupPrivilegeValueA

msvcrt

fopen
printf
fscanf
fclose
??2@YAPAXI@Z

Exports

Exports

CompareLinkInfoReferents
CompareLinkInfoVolumes
CreateLinkInfo
CreateLinkInfoA
CreateLinkInfoW
DestroyLinkInfo
DisconnectLinkInfo
GetCanonicalPathInfo
GetCanonicalPathInfoA
GetCanonicalPathInfoW
GetLinkInfoData
IsValidLinkInfo
MSCON
ResolveLinkInfo
ResolveLinkInfoA
ResolveLinkInfoW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 798B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ