124593c5fc6acf05a18929abfce63ecf | Triage

Sharing

General

Target

124593c5fc6acf05a18929abfce63ecf
Size

6KB
MD5

124593c5fc6acf05a18929abfce63ecf
SHA1

42694f161a3cf601e899b1536a49adb93a9eb0db
SHA256

3ee088daba393e6571053e3a70cce79bcaa302846fb0475350fb4436a95f4ce8
SHA512

2f4cf6ec9dc753b036a88d6f82c432d2827999af1584f1cd7aaffd6fe15d46b3d933f44c9e4e67f0b4df30d05f51ad57dde9cf3752bd54354d02069a500e3130
SSDEEP

96:hIgc55xj/inZ1kJDTDM5MwjPK/g/ve1JODYY7i:hFyHj2oTD7gDW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
124593c5fc6acf05a18929abfce63ecf

Files

124593c5fc6acf05a18929abfce63ecf
.dll windows:4 windows x86 arch:x86

0c3da04b9115c9dedf21d723dde8caef

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

imagehlp

ImageDirectoryEntryToData

kernel32

GetCurrentProcessId
lstrcmpA
lstrcpyA
lstrlenA
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
GetModuleHandleA
GetProcAddress
CreateToolhelp32Snapshot
OpenFileMappingA
GlobalAlloc
WriteProcessMemory
VirtualProtectEx
GetCurrentProcess
lstrcmpiA
CloseHandle
Module32Next
Module32First
GetModuleFileNameA

user32

SetWindowsHookExA

Exports

Exports

HideProcess

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: - Virtual size: 568B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 440B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ