09cff477a5a636a286ceaa2ee7a1eba4 | Triage

Sharing

General

Target

09cff477a5a636a286ceaa2ee7a1eba4
Size

10KB
MD5

09cff477a5a636a286ceaa2ee7a1eba4
SHA1

1c28baa013ac185104ede9082157009c4f480767
SHA256

79fbc2fbb39adb1fa5d316057722fe2336fabc93a353a0fd473c72a1a07d81fd
SHA512

43a2a833ef787916f019a0225429ff4ffa89b8a95c3e77a19a91158f8d00705f7e0f1c029731392e4a1ca85d1cf7bdaf834a3cc3a07222c192d78b9c00e48844
SSDEEP

192:ayQfTUX6tSTSSk8Qrwlo0pfKKJn23Iqq:ay0TUKtSTrktMlztc3I

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
09cff477a5a636a286ceaa2ee7a1eba4

Files

09cff477a5a636a286ceaa2ee7a1eba4
.dll windows:4 windows x86 arch:x86

7a7822861c99ad89fc8a6f9c731eaea9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MultiByteToWideChar
Sleep
VirtualProtectEx
GlobalFree
ReadProcessMemory
WideCharToMultiByte
GlobalAlloc
IsBadReadPtr
GetPrivateProfileStringA
GetProcAddress
GetModuleHandleA
CreateThread
GetModuleFileNameA
GlobalLock
GetCurrentProcess

user32

CallNextHookEx
SetWindowsHookExA

wininet

InternetReadFile
InternetCloseHandle
InternetOpenA
InternetOpenUrlA

msvcrt

_adjust_fdiv
malloc
_stricmp
_initterm
free
strrchr
??3@YAXPAX@Z
strcpy
??2@YAPAXI@Z
sprintf
strlen
strncpy
strchr
strstr
fclose
fread
fopen
memset
memcpy
strcmp

Exports

Exports

fx

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 568B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sdt
Size: 512B - Virtual size: 269B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 668B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ