1249793567a7a488e98f2af3d7dda877 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1249793567a7a488e98f2af3d7dda877
Size

28KB
MD5

1249793567a7a488e98f2af3d7dda877
SHA1

2eb328e57edfe25cf4c4437bae80f7c706e8a5b4
SHA256

9c5097524716297671c5f3901758f9916eb2447892c68694bb277a78082f99ba
SHA512

6534876d9030400546069e5b5c7cf96700ded2ad98c3a97ab0fc0bd808e92a134c024d79183af49561f8b649e1cebd369d1778b8dcb136547debcfec85b8c390
SSDEEP

192:jpSx9cL8mOUw6c/1Wpm9XW1G/8y+DeP1PIahPxVqc5DNYLR9WgbgS:jpMcLqUAx9Xz9+DeP1PIahPGcpNYtsM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1249793567a7a488e98f2af3d7dda877

Files

1249793567a7a488e98f2af3d7dda877
.dll windows:4 windows x86 arch:x86

bbc50dbbc8b32cec1dc493079a1c0fb4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

free
_initterm
malloc
atoi
memcpy
strcmp
strstr
strrchr
fseek
ftell
??2@YAPAXI@Z
strchr
strncpy
??3@YAXPAX@Z
fopen
fwrite
fclose
fread
time
_adjust_fdiv
memset
_strlwr
_itoa

kernel32

Sleep
CreateThread
LoadLibraryA
CopyFileA
GetProcAddress
GetTempPathA
lstrcmpA
lstrcpyA
lstrlenA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
GetModuleFileNameA
lstrcatA
ExitProcess

Sections

.text
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ