0264dc6de07db685b2914d4b619cb34b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0264dc6de07db685b2914d4b619cb34b
Size

17KB
MD5

0264dc6de07db685b2914d4b619cb34b
SHA1

631f599c710430a2110e2dd713828f23fb6dd17c
SHA256

27edf411cbbca796280d2782dc75232b6ac9b3755a3d2b3e724c2600123e88aa
SHA512

2224637c43f11201d31d0d4aeff765ac7b3b274dc3f8c841e04f573784b38b730642fe6492756a251606d93b5de344caa1cc351ee7583f43f98aedf70c1a4a05
SSDEEP

384:EN4ZZRTz48Pefj3IS1+Ghddq+4Gm3dokqUNtC4:EN4zxvesST7A+19kqUXC4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0264dc6de07db685b2914d4b619cb34b

Files

0264dc6de07db685b2914d4b619cb34b
.dll windows:4 windows x86 arch:x86

9dfbe2747791414523d84573f94a76c8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetSystemDirectoryA
GetCurrentProcessId
FreeLibrary
GetTempPathA
Sleep
GetWindowsDirectoryA
lstrcatA
CreateThread
DisableThreadLibraryCalls
GetCurrentProcess
LoadLibraryA
ExitProcess
CreateMutexA
GetProcAddress

user32

GetWindowTextA
PostMessageA
GetForegroundWindow
wsprintfA
keybd_event
FindWindowExA

advapi32

DeleteService
LookupPrivilegeValueA

msvcrt

fopen
printf
fscanf
fclose
??2@YAPAXI@Z

Exports

Exports

CompareLinkInfoReferents
CompareLinkInfoVolumes
CreateLinkInfo
CreateLinkInfoA
CreateLinkInfoW
DestroyLinkInfo
DisconnectLinkInfo
GetCanonicalPathInfo
GetCanonicalPathInfoA
GetCanonicalPathInfoW
GetLinkInfoData
IsValidLinkInfo
ResolveLinkInfo
ResolveLinkInfoA
ResolveLinkInfoW
Rsll

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 794B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ