1fd75f8878345673993182220544bc41 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1fd75f8878345673993182220544bc41
Size

19KB
MD5

1fd75f8878345673993182220544bc41
SHA1

2d02edc4656d9403a68443717528f5d93e3ab5ca
SHA256

afdc87e271625fc097dd3de3575924d403642687321d0cc306e0ff052c629faa
SHA512

559310d33a4d31282c7731acdf77320155215f3924776006bee78750a47b8c064d20f9a066920cc598444988da6a365071b23e9e34d66beb061716da0ef73e5a
SSDEEP

192:wNMxVb2GRzyb8mMduiQou3g0UATs79HWekknzRvg5gMnR0PDDSh5NM93r4lXoyvl:wWViv4mxKu5s9zzyO+i3r4Foyvp10M

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1fd75f8878345673993182220544bc41

Files

1fd75f8878345673993182220544bc41
.dll windows:4 windows x86 arch:x86

cf51304fec517cf85c3097e04f82ff7d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

WSACleanup
WSAStartup
recv
closesocket
send
gethostbyname
htons
socket
connect

kernel32

GetModuleFileNameA
OpenEventA
SetEvent
VirtualQuery
CreateThread
GetTickCount
lstrcatA
lstrlenA
GetWindowsDirectoryA
GetSystemDirectoryA
lstrcmpiA
lstrcpyA
lstrcpynA
GetSystemTime
Sleep
GlobalFree
GlobalAlloc
lstrcmpA
DeleteFileA
GetTempFileNameA
GetTempPathA
WinExec
RtlUnwind
CloseHandle
WriteFile
CreateFileA
CreateProcessA
GetLastError
FileTimeToSystemTime
FindClose
FindFirstFileA
GetComputerNameA
CreateMutexA
ExitProcess

user32

SetWindowsHookExA
CallNextHookEx
SendMessageA
CharLowerA
wsprintfA

advapi32

RegCreateKeyA
RegQueryValueExA
RegCloseKey

Exports

Exports

Activate

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 556B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ