010855a44836e1b50a74d9a5e57291d0 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

010855a44836e1b50a74d9a5e57291d0
Size

58KB
MD5

010855a44836e1b50a74d9a5e57291d0
SHA1

b5d769dfe81400d2c89747b211802b518bb9f3c5
SHA256

f0f53a00f991c867986b6e06de856ca5812d5e5ddd910277848d27b77739e310
SHA512

b4afeb06f01f166d6c1d8581c8f48ea7cbd4a664bbc6e9ab1e8b5683bab31d6ebded18d8788e557f8c04de3a669d505bd5acfca7a4a5c09b9cf0a604e3acb32e
SSDEEP

768:oRkf3tuNnYkm4ykYYJ+E5DzCxnztSAV8xSv/d1RHYTg/8v9Yhd1taNRg/wunP9:oRg8NnYBnYtGhDhT4SEWtaNRg/wunF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
010855a44836e1b50a74d9a5e57291d0

Files

010855a44836e1b50a74d9a5e57291d0
.dll windows:4 windows x86 arch:x86

6676615c9bac8d4cab721d624b3a5e2a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

oleaut32

SysFreeString

advapi32

RegQueryValueExA

user32

GetKeyboardType

gdi32

SelectObject

wsock32

TransmitFile

ws2_32

WSAWaitForMultipleEvents

urlmon

URLDownloadToFileA

wininet

InternetReadFile

shell32

ShellExecuteExA

ntdll

NtQuerySystemInformation

avicap32

capGetDriverDescriptionA

imagehlp

MakeSureDirectoryPathExists

powrprof

CallNtPowerInformation

winmm

waveInUnprepareHeader

msvfw32

ICCompressorFree

Exports

Exports

ServiceMain

Sections

.text
Size: 50KB - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE