023d2e8f6030401bf1bd49f0db26d953 | Triage

Sharing

General

Target

023d2e8f6030401bf1bd49f0db26d953
Size

28KB
MD5

023d2e8f6030401bf1bd49f0db26d953
SHA1

7c708426169ad8c2ce03b719a17867b9d09a35ef
SHA256

105219ecbb354b8097d5a11cba453733211c0d9747018b456b6995b31a7d9a3a
SHA512

30c0e9759e157c42723f7b9a89f2bc0caad0b46f8a74a25fc8105d273aecc52486a8f575e464ca0ba1f2e3e2df4832bea353ee28b78e7cbe73512358fea3d864
SSDEEP

192:QfwYOi+sdA5WvxwAT6QzBQHpKhF0Hakh4JcDdK+RwOEzALfRpct5UFbpwTSg:Qfw85A4vxw1QzQBzCJuK+lQALppct5K

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
023d2e8f6030401bf1bd49f0db26d953

Files

023d2e8f6030401bf1bd49f0db26d953
.dll windows:4 windows x86 arch:x86

df7e7367b810b262a31dd4452638304d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_adjust_fdiv
memset
malloc
_initterm
free
memcmp
atoi
memcpy
strstr
strrchr
fseek
ftell
strchr
strncpy
??2@YAPAXI@Z
??3@YAXPAX@Z
fopen
fwrite
fclose
fread
time
_strlwr
_itoa

kernel32

ExitProcess
Sleep
LoadLibraryA
CopyFileA
GetProcAddress
CreateThread
GetTempPathA
lstrcmpA
ResumeThread
lstrlenA
lstrcpyA
CreateRemoteThread
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory
GetModuleFileNameA
lstrcatA

Sections

.text
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 956B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 788B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ