0025ef86023521edbff410dab592289b | Triage

Sharing

General

Target

0025ef86023521edbff410dab592289b
Size

21KB
MD5

0025ef86023521edbff410dab592289b
SHA1

789756267a0e8f6ad758b0ac7381473b37eb1726
SHA256

e3169d40958f9e8fdfcefc9c99a3ab8f59ace621454f42b548e4bcca62c0f9be
SHA512

6f2e9768e1e48b78a7dbb56f7d34dc492ce8a6fa37869c18c46bbb7b133a7053f44668c3e95af14facc78d3922c70c76a575317b33d0859d23e6cc3598a24420
SSDEEP

384:gPZ2+14X8X64VoQqiLEtO8p93RxBXSky4almIxAJzWWej/:2ZV14X8X6YXLLEM+3RKB4afWg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0025ef86023521edbff410dab592289b

Files

0025ef86023521edbff410dab592289b
.dll windows:4 windows x86 arch:x86

ab01f3b7af7216ebde55f5c8e7241f26

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FreeLibrary
GetProcAddress
LoadLibraryA
lstrcatA
GetSystemDirectoryA
IsBadReadPtr
VirtualProtect
CloseHandle
Process32Next
lstrcmpiA
Process32First
CreateToolhelp32Snapshot
lstrcmpA
TerminateProcess
OpenProcess
GetPrivateProfileStringA
Sleep
lstrcpyA
lstrlenA
GetTickCount
lstrcpynA
WritePrivateProfileStringA
GetSystemTime
GetTempPathA
GetModuleFileNameA
GetModuleHandleA
ReadFile
SetFilePointer
CreateFileA
CopyFileA
CreateThread
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
GetLastError
CreateMutexA

user32

CallNextHookEx
SetWindowsHookExA
GetWindowTextA
PostThreadMessageA
FindWindowA

Exports

Exports

COMResModuleInstance
VVVV
YYYY

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ