10c8222b3a40516a1fb69e1e162a0899 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

10c8222b3a40516a1fb69e1e162a0899
Size

12KB
MD5

10c8222b3a40516a1fb69e1e162a0899
SHA1

49390570b99c4ba2c5817b1026858d13bb94a18a
SHA256

834f03878c38883260cc083dbf9a474a8f635bbfe4038282fc3072bf17050c03
SHA512

9b7a2a6346251f9c98c3a824831ca30553f4d67d027167ce19995b9b8f0e7db4a96da4437d1d9924b8097aa8e8dbb10f298646a556c790acc303a8d3ad4db3c9
SSDEEP

96:zcvge0Td0YncgRKHjUsXf89bnYvNhL3NhLfDOXBvIxpXJ4clO4Xo2hcTj:b6Ycgk9Xf2YbHHOXBvIxlmAvhcTj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
10c8222b3a40516a1fb69e1e162a0899

Files

10c8222b3a40516a1fb69e1e162a0899
.dll windows:4 windows x86 arch:x86

61b349cd8b1e389318198b79f4190ddd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

RegCreateKeyExA
RegDeleteValueA
RegOpenKeyExA
RegSetValueExA
RegCloseKey

kernel32

CloseHandle
CopyFileA
CreateEventA
CreateFileA
CreateProcessA
CreateThread
DeleteFileA
FreeLibrary
GetExitCodeProcess
GetLastError
GetModuleFileNameA
GetSystemDirectoryA
GetTempPathA
GetTickCount
LoadLibraryA
OpenEventA
ResumeThread
SetErrorMode
SetEvent
Sleep
WaitForSingleObject
WriteFile

wsock32

recv
gethostbyname
connect
closesocket
WSAStartup
socket
send
WSACleanup

user32

SetWindowsHookExA
PostThreadMessageA
GetWindowThreadProcessId
FindWindowA
CallNextHookEx
UnhookWindowsHookEx

Exports

Exports

init

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 208B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ