0b3541dc2ab696aebe9431752ef9319e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0b3541dc2ab696aebe9431752ef9319e
Size

24KB
MD5

0b3541dc2ab696aebe9431752ef9319e
SHA1

8ecfbc318ffdc10f2c9dcbb0f491cba0f85cf9ce
SHA256

6b9b7650662eedef72d6291023fc67902ae71909fad360085b8049e8aadc3240
SHA512

2844e29ed2a100ccdfd9f4f627b946e1fb0fd280f13f777eb1add3655b911648932dfbbbdf1ab5ed706baea28903e3628531c9c49e661bb0b86335cbb9f29f76
SSDEEP

192:ZGb58ux9Qk9BWrMUZBc9Vazj3Dewspct5U9l1u0:MtLx9Qk9oBBfzj3Dewspct5c

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0b3541dc2ab696aebe9431752ef9319e

Files

0b3541dc2ab696aebe9431752ef9319e
.dll windows:4 windows x86 arch:x86

ab4410bf31c1e89eb7351a7ae5eebfc4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

GetKeyboardState
MapVirtualKeyA
ToAscii

msvcrt

_adjust_fdiv
_itoa
malloc
_initterm
free
strchr
strcmp
atoi
memcpy
??3@YAXPAX@Z
??2@YAPAXI@Z
strstr
fopen
fwrite
fclose
fread
time
memset
_strlwr

kernel32

GetModuleHandleA
CreateThread
TerminateProcess
lstrlenA
LoadLibraryA
CopyFileA
GetProcAddress
GetModuleFileNameA
GetTempPathA
Sleep
EnterCriticalSection
lstrcmpA
lstrcpyA
LeaveCriticalSection
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory
InitializeCriticalSection

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 724B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ