1f5f5ed69be976b24779b2a4f5be806a | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1f5f5ed69be976b24779b2a4f5be806a
Size

20KB
MD5

1f5f5ed69be976b24779b2a4f5be806a
SHA1

0dc3e367bde90af6d720c7d9307e836ecd07504c
SHA256

e73461c195241028a2ea273a143e1c87302ccc27830a4a30aba5f7c192d02e83
SHA512

6c8bdaee904125a8fe1ed4b11154f6d5d952485c66a25f0f68cc761dc19d1307bd9e6a4b95712c228c9036a71ec0f16a04b83d5607fafcd271133bb10d094014
SSDEEP

24:eH1GSQgaCVwsLtazspUiQq7JxjvWLg5gNG:yQzCVwsLtlTQ0x0gH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1f5f5ed69be976b24779b2a4f5be806a

Files

1f5f5ed69be976b24779b2a4f5be806a
.dll windows:4 windows x86 arch:x86

e02cbd6ce5a0b4d4bdb8c16b6ff2fae4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

VirtualProtect
lstrcmpiA
IsBadReadPtr
GetProcAddress
GetModuleHandleA
IsBadCodePtr
SetLastError
DisableThreadLibraryCalls

user32

FindWindowA
GetWindowThreadProcessId

Sections

.text
Size: 4KB - Virtual size: 416B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 368B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 84B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ