0d18167ae48c3a07a79efb5595f96053 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0d18167ae48c3a07a79efb5595f96053
Size

4KB
MD5

0d18167ae48c3a07a79efb5595f96053
SHA1

69216cf39e76fd9b8ab71e5061a1b5c4293f559d
SHA256

07414c588b92661ae4cc7b896e2316af2e96b0a050a11cac86ddf4edcc01db41
SHA512

baf78f3d3b13fe8534ef5551f5bb92617648e02cdb9260855c8797e863cf42976465276e5fc7de03209b32f059bee469113bdbb74b5adc94e2d7a1008380978f
SSDEEP

48:CjxZRq9+bdKcdpUN57qiKWtBdBmyjthgmF7mcF:0+gdzql5VJlF6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0d18167ae48c3a07a79efb5595f96053

Files

0d18167ae48c3a07a79efb5595f96053
.dll windows:4 windows x86 arch:x86

1e7905d43cafef269a60a4e038680f0f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

VirtualProtect
IsBadStringPtrA
lstrcmpiA
lstrlenW
lstrcpyW
CloseHandle
Module32Next
GetCurrentProcess
CreateToolhelp32Snapshot
GetCurrentProcessId
GetModuleFileNameA
GetModuleHandleA
HeapAlloc
Module32First
WriteProcessMemory
GetProcessHeap

user32

CallNextHookEx
SetWindowsHookExA

advapi32

RegOpenKeyExW

Exports

Exports

SetHook

Sections

.text
Size: 1024B - Virtual size: 957B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 819B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.shr
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 166B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ