0cb534a9f46f8e1f83ff05845b56a42f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0cb534a9f46f8e1f83ff05845b56a42f
Size

7KB
MD5

0cb534a9f46f8e1f83ff05845b56a42f
SHA1

79e2429480185dfa66d39350200391a20e15d97d
SHA256

0b84ffdf947effccf692d2cd288046b1e5e81756ff419316bee15e9b3696ff00
SHA512

f8fc90f8e632e93811136a3926778808060deb9d7b6722a59bc2a71afb833c03c86ee7f5065eb8afdb7f99e5bf64949122214cdd830158d9b16aed468f9ab7d5
SSDEEP

192:SR3DJgJvkozwtF2jVeqtOgt3pDoxta9BqQQ6:oJg5Vwn2jVNtlpDrBq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0cb534a9f46f8e1f83ff05845b56a42f

Files

0cb534a9f46f8e1f83ff05845b56a42f
.dll windows:4 windows x86 arch:x86

c7a096da09524841b71aabe159408149

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_except_handler3
strrchr
strstr
free
malloc
strchr
strncpy
_initterm
_adjust_fdiv

kernel32

HeapAlloc
GetProcessHeap
VirtualProtect
CloseHandle
CompareStringA
IsBadReadPtr
LoadLibraryA
GetModuleHandleA
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
GetProcAddress
OpenProcess
GetCurrentProcess
lstrlenA
CreateThread
FreeLibrary
GetModuleFileNameA

user32

wsprintfA
GetWindowThreadProcessId
FindWindowA
SetTimer
KillTimer
TranslateMessage
DispatchMessageA
GetMessageA

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken

wininet

InternetCloseHandle
InternetReadFile
InternetOpenUrlA
InternetOpenA

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 510B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ