106669fa2f1814eb325af5cb046747b1 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

106669fa2f1814eb325af5cb046747b1
Size

24KB
MD5

106669fa2f1814eb325af5cb046747b1
SHA1

8af45d9d90f37f1a0bda1f781e6d12d395a53a0e
SHA256

6c21fb8a60a93c705e1f27139b09d5d48a3c95c3a16264fa727cad4ac63495f0
SHA512

82c8f371639446541a921d2a1b2361a9d66d313550f570bb7d9f0478c63fbf77bf05de4cfbb5eb52c9c3d0d028113d7b25e3fd24a2b7d613191bade702001acc
SSDEEP

192:jJn3dPHlZaA4xdOHy2VfT0sFivP0U3rGKK/G5y+6GZoZ2paqg:jJNPnaLOPpT0scX0U3yNG/6Up

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
106669fa2f1814eb325af5cb046747b1

Files

106669fa2f1814eb325af5cb046747b1
.dll windows:4 windows x86 arch:x86

8bc8868032a0b5230f2d86138aabeedd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

FindWindowA
GetWindowTextA

msvcrt

_adjust_fdiv
malloc
_initterm
free
strlen
atoi
memcpy
strstr
??3@YAXPAX@Z
??2@YAPAXI@Z
memset
_strlwr

kernel32

VirtualProtectEx
TerminateProcess
CreateThread
OutputDebugStringA
GetModuleHandleA
Sleep
LoadLibraryA
GetTempPathA
CopyFileA
GetProcAddress
GetModuleFileNameA
lstrlenA
lstrcatA
GetCurrentProcess
WriteProcessMemory
GetCurrentProcessId
ReadProcessMemory
lstrcpyA

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 876B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 624B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ