058dc54ee74502d8391263b34e616364 | Triage

Sharing

General

Target

058dc54ee74502d8391263b34e616364
Size

34KB
MD5

058dc54ee74502d8391263b34e616364
SHA1

1ff0da9746ae25173edb519c8935d2cbc41b6c16
SHA256

4e0a962f4d52f48b7ab463f8e26dd47830ccd0bf9c383e55d0a04f4adf3a5cfa
SHA512

3d7a8eb3f8a34a853b27d1ff497c6bfc177b6aad6420b2869d0520b9f26131552409d9059c4bc36a9f3889e85e8a147919e569c66b321ee9d02ff82a07f4c65b
SSDEEP

384:eWnlUoAHwGNEnGAdVEoyfshfKL8OxFmQ:eW+oAH9AbEoyUZi8kmQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
058dc54ee74502d8391263b34e616364

Files

058dc54ee74502d8391263b34e616364
.dll windows:4 windows x86 arch:x86

a9dc9b614c08ce41bae1850bd3f1e617

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

socket
connect
bind
recvfrom
listen
accept
WSAStartup
gethostbyname
send
htons
sendto
closesocket
select
__WSAFDIsSet
recv

wininet

InternetConnectA
InternetGetConnectedStateEx
InternetOpenA
InternetOpenUrlA
InternetCloseHandle
InternetReadFile
FtpPutFileA

urlmon

URLDownloadToFileA

kernel32

WinExec
GetWindowsDirectoryA
CreateThread
Sleep
lstrcatA
lstrcmpA
CreateFileA
ReadFile
SetFilePointer
WriteFile
CloseHandle
GetFileSize
GlobalAlloc
GlobalFree
lstrcpyA
lstrlenA

user32

CharLowerBuffA

advapi32

RegQueryInfoKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 896B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ