0c18eb8470010d470228d1d35d8fed0a | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0c18eb8470010d470228d1d35d8fed0a
Size

28KB
MD5

0c18eb8470010d470228d1d35d8fed0a
SHA1

54d29c71d656c7c90aab033265062135aa3397ae
SHA256

20d9448ae7c656180bc4114e8e41f7d6a1a22239ad5d3adb5f0cbf23490edeed
SHA512

e962a2b5be1878b3c392c7934e400f4639887c3289a580f9794fc088813af3eb84bf33b28889837bdc97be1004064e0ccb50da463e5a38e7a5e2608da3cd0445
SSDEEP

384:mKZzTIcf9obSbGBBm0u6XghAoC9eFW4K0pct5NJ6H:LzTVfrbG1unh/C9eFW4Xat5I

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0c18eb8470010d470228d1d35d8fed0a

Files

0c18eb8470010d470228d1d35d8fed0a
.dll windows:4 windows x86 arch:x86

9fcb03b0e02accc739b2fa05ff6d0d3a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

closesocket
ntohs
ntohl

msvcrt

strchr
free
memcmp
malloc
_adjust_fdiv
_itoa
atoi
memcpy
strncpy
strcmp
sprintf
??3@YAXPAX@Z
??2@YAPAXI@Z
strstr
fopen
fwrite
fclose
fread
time
memset
_strlwr
_initterm

kernel32

Sleep
GetCommandLineA
ExitProcess
GetModuleHandleA
LoadLibraryA
CopyFileA
GetProcAddress
GetModuleFileNameA
GetTempPathA
lstrlenA
lstrcpyA
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory
CreateThread

Sections

.text
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1014B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 758B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ