014d4f4f4814ebec20b29b0ace8ac524 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

014d4f4f4814ebec20b29b0ace8ac524
Size

8KB
MD5

014d4f4f4814ebec20b29b0ace8ac524
SHA1

f5bbbbfa20a7d8ce333923e54e12a1debeaea044
SHA256

b2894e3689791b33f55044155d0e34f87f78b2dff97c82e98ef1957bf3ba5fb2
SHA512

c76aaa57416f3f31466e01e0d6be32ef116fdee49645d8e7b73d795eca1789e1b2062415fbbf8c31a692cb0ae9ecee71efa10b898c252051371929bc005c88f1
SSDEEP

192:WMV2w6+lPg+FdnUevV+IhGbEyVf3X/H7z:H2wFPg+FdJdnGEytvH7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
014d4f4f4814ebec20b29b0ace8ac524

Files

014d4f4f4814ebec20b29b0ace8ac524
.dll windows:5 windows x86 arch:x86

9005a99f82f215f3f666311df9df3dcc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wininet

InternetCloseHandle
InternetOpenA
InternetOpenUrlA

kernel32

QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
VirtualProtect
WideCharToMultiByte
Sleep
lstrlenW
SetFileAttributesA
GetModuleFileNameA
GetModuleHandleA
IsDebuggerPresent
DecodePointer
EncodePointer
IsProcessorFeaturePresent

msvcr120

_beginthread
??2@YAPAXI@Z
malloc
_amsg_exit
_malloc_crt
memcmp
_initterm_e
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
__clean_type_info_names_internal
_except_handler4_common
free
_vsnprintf_s
sprintf
__CppXcptFilter
_initterm

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 948B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 424B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ