08d126a0fd69e79d042b8eeeb6772a61 | Triage

Sharing

General

Target

08d126a0fd69e79d042b8eeeb6772a61
Size

24KB
MD5

08d126a0fd69e79d042b8eeeb6772a61
SHA1

eee3237303f34e86f440b587e4edb4507297ecf0
SHA256

30a6b92ee2a3658a052d08447db1cbbdf02f5bdfbaf56d65b201c20b8de7f85a
SHA512

13b44b6a59ca707bb2e2dc6aff56e75a56cc54cb9c9608d0e4ea0a2c20a54bfbe9492e55a74e563275bd8ed73d4dea3f03b2eb5d2cdbe277bdd0b995ace8e18c
SSDEEP

384:1QiN5YXnNZPcOUIbfuiGGO1kCiIKvCpct5mAaSdy:LNwnNl/bGHGOyvqat5mnSg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
08d126a0fd69e79d042b8eeeb6772a61

Files

08d126a0fd69e79d042b8eeeb6772a61
.dll windows:4 windows x86 arch:x86

fde4da56fef580c4b857246cd861cc48

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

GetKeyState
GetKeyboardState
MapVirtualKeyA
VkKeyScanA
ToAscii
GetWindowTextA
EnableWindow
FindWindowA
FindWindowExA
EnumChildWindows

msvcrt

free
_initterm
malloc
_adjust_fdiv
_itoa
srand
strcmp
rand
strchr
strcpy
strstr
fopen
fwrite
fclose
fread
time
??2@YAPAXI@Z
memset
memcpy
??3@YAXPAX@Z
_strlwr
atoi

kernel32

LeaveCriticalSection
GetModuleFileNameA
ExitProcess
GetTickCount
InitializeCriticalSection
CopyFileA
CreateThread
GetTempPathA
EnterCriticalSection
lstrlenA
LoadLibraryA
GetProcAddress
VirtualAllocEx
GlobalAlloc
GlobalLock
CreateRemoteThread
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory
Sleep
lstrcmpA
lstrcpyA

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 850B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ