00c0c1054c3b6419ebab444aa28c2fe4 | Triage

Sharing

General

Target

00c0c1054c3b6419ebab444aa28c2fe4
Size

9KB
MD5

00c0c1054c3b6419ebab444aa28c2fe4
SHA1

80648135c61cd4bf9579539822c72467b5201e4d
SHA256

f225e8d85c031356eb12223bb9152a3d5fd216f29d13e14fc2e96c42fef12ce7
SHA512

55a9b16bd3e62e3d2e0cda3eb3caf529047c2c2b817af8fb42fb14db4df942b2d7f2d71ab91ac38f2bed962beee03f3f46c0a3207b034a36a6db4830c9ded39e
SSDEEP

192:1gFnx6P4Ip9dmf+JtaydGrQX2mGgkoZ9m/wk1TrAd8q:1o6PMfRyG5P/wMTD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
00c0c1054c3b6419ebab444aa28c2fe4

Files

00c0c1054c3b6419ebab444aa28c2fe4
.dll windows:4 windows x86 arch:x86

0a0e4ed2e3e73ab9afea2cbf584a962b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WriteProcessMemory
VirtualProtectEx
ReadProcessMemory
GetCurrentProcess
CloseHandle
CreateThread
GetModuleFileNameA
GetComputerNameA
GetCurrentProcessId
GetModuleHandleA
IsBadReadPtr
ExitProcess
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
Sleep
VirtualFree
GetProcAddress
VirtualAlloc

user32

CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
GetWindowTextA
wsprintfA
FindWindowA
GetWindowThreadProcessId

advapi32

AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueA

wininet

InternetOpenUrlA
InternetOpenA
InternetCloseHandle

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sdata
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 508B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ