0a2fcf5d10d0cb628bcca4f6f4059d40 | Triage

Sharing

General

Target

0a2fcf5d10d0cb628bcca4f6f4059d40
Size

42KB
MD5

0a2fcf5d10d0cb628bcca4f6f4059d40
SHA1

57e2ca973b6e55dbda5d94459e9db19c9ba6291e
SHA256

cb7270df6eebae8bc408786c187d4044bc7f1bafeeef5a49ffcd5b0f44afb391
SHA512

05e6f8d37d606c6f532066721a28baef237ebc89763c911f8872d47f25e5cad75c94bdf19b4dec23fabeb82cbcf6a2eecf55ada69bf2763fe3fc64aa6a90e6f3
SSDEEP

768:hkYC/yFF/waeFJxzIEXvNjoQEt0+piR3xtLc8yxzqyI9f4rWfKx21HB:hkYCq7wae5Iw6pe+pu37Ly+9W4P

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0a2fcf5d10d0cb628bcca4f6f4059d40

Files

0a2fcf5d10d0cb628bcca4f6f4059d40
.dll windows:4 windows x86 arch:x86

1972290ea4c66eacc3f3ee56568befce

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

_stricmp
RtlImageNtHeader
strrchr
_snwprintf
ZwOpenEvent
RtlCreateRegistryKey
ZwLoadDriver
RtlAdjustPrivilege
RtlWriteRegistryValue

kernel32

GetModuleFileNameA
LoadLibraryExA
GetModuleHandleA
VirtualProtect
FreeLibrary
SetEvent
CloseHandle
MoveFileExA
WriteFile
SetFilePointer
CreateFileA

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 736B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 464B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ