0883c2b6940917f915aafd36a4e257cd | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0883c2b6940917f915aafd36a4e257cd
Size

24KB
MD5

0883c2b6940917f915aafd36a4e257cd
SHA1

115fa7a0fc2adbaa44f8e8ddc71992cde9122a81
SHA256

159f073607b715467a25a102ce9b67364f40630d08ecd6bee63c67d34f381d63
SHA512

7847656f3b4ff922448ad60abc22e566983aee999214e16bdcf2da6186f8ce08333b24c4ec804d49d968a7c14acdc01b351022bba621c43b544d6e9e26af44ba
SSDEEP

192:z0Lo77sJtVyDVgxkQ6PJ2Rc0eOmEwrj92UyGpct5U1Pb:Q+YsgiQywcimEw/91yGpct5MP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0883c2b6940917f915aafd36a4e257cd

Files

0883c2b6940917f915aafd36a4e257cd
.dll windows:4 windows x86 arch:x86

a08fc059f2db2a9ad7c8e480f61443c7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

closesocket
ntohs
ntohl

msvcrt

memcpy
atoi
free
sprintf
malloc
_adjust_fdiv
_strupr
strstr
strrchr
fseek
ftell
??2@YAPAXI@Z
strchr
strncpy
??3@YAXPAX@Z
fopen
fwrite
fclose
fread
time
memset
_strlwr
_itoa
_initterm

kernel32

Sleep
GetModuleHandleA
lstrlenA
LoadLibraryA
CopyFileA
GetProcAddress
GetTempPathA
lstrcmpA
OutputDebugStringA
lstrcpyA
ReadProcessMemory
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory
GetModuleFileNameA
lstrcatA
CreateThread

Sections

.text
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 736B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ