0b09e721d03602cf33b5face47fcc612 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0b09e721d03602cf33b5face47fcc612
Size

10KB
MD5

0b09e721d03602cf33b5face47fcc612
SHA1

7e11fe1e4c7c489408c099dccac9a7c14d229bce
SHA256

19d4091672b6d2ca461acb67a6934c6faf7162da6bc02f1190762282b456a549
SHA512

90ceab2ae2a190a3d4d0f872be4c7f054a28c254adfc16e0f8100bb1afe8e53876ed7b246def5bca6d3826f8d281e0c4f972bc204d8e25a6b8a0322e9add842a
SSDEEP

192:zEkorV46+l/wB7zFnWUYtZeOhHGBvKyDV0RmPD+SWKv0:gFrBliKvKKVQSWKv0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0b09e721d03602cf33b5face47fcc612

Files

0b09e721d03602cf33b5face47fcc612
.dll windows:4 windows x86 arch:x86

c5451ffd08effea41f2ee885f536b124

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
CompareStringA
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
GetProcAddress
GetModuleHandleA
OpenProcess
CreateThread
GetModuleFileNameA
IsBadReadPtr
GetCurrentProcess
FreeLibrary
GetCurrentThreadId
InterlockedExchange
RtlUnwind
VirtualProtect
GetProcessHeap
lstrlenA
HeapAlloc
VirtualQuery

user32

TranslateMessage
GetMessageA
KillTimer
SetTimer
FindWindowA
GetWindowThreadProcessId
DispatchMessageA
wsprintfA

advapi32

AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueA

wininet

InternetOpenUrlA
InternetReadFile
InternetCloseHandle
InternetOpenA

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 650B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ