0d4a7d48e2eb3a0b450f07b900060f31 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0d4a7d48e2eb3a0b450f07b900060f31
Size

2.4MB
MD5

0d4a7d48e2eb3a0b450f07b900060f31
SHA1

7919aceb5be3a4267c8606734d2434006fa29862
SHA256

fe84589a4763354ea6f0f25a886b92efcbb32762b8132a3a4bba932dcadfbe07
SHA512

167cffa87528103bc2fc147205d1c607d55badb00989fe8b67b9400cbdfc7f1b36d1ccd7be8b234f3f40f2296b21f60b3de962f0ba66a0b8b41b396a74a15ac0
SSDEEP

49152:1j1FhW825PlJ0TJcttcCmIf+u9YZrpk9BRVvdWaiiccTlwcu2EFYN:1jTo82Pb0c0NZrq9BRVvUdowc9N

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0d4a7d48e2eb3a0b450f07b900060f31

Files

0d4a7d48e2eb3a0b450f07b900060f31
.dll windows:4 windows x86 arch:x86

c48968f80eae1035d6e52a1562e9fa0f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentProcess
Sleep
GetModuleFileNameA
CloseHandle
SetEvent
IsBadReadPtr
GetFileSize
ReadFile
SetFilePointer
CreateFileA
HeapAlloc
GetProcessHeap
VirtualProtect
TerminateProcess
GetProcAddress
GetModuleHandleA
LoadLibraryW
MultiByteToWideChar
LoadLibraryA
OpenEventA
CreateEventA
CreateThread

user32

SetWindowsHookExA
CallNextHookEx
wvsprintfA
wsprintfA
BroadcastSystemMessageA

msvcrt

memcpy
_strcmpi
_adjust_fdiv
strcpy
strcat
strlen
strncpy
strstr
memset
sprintf
free
malloc
_except_handler3
strrchr
realloc
_strlwr
_initterm

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ