129eab165ceea0ba8440422c7b775fcc | Triage

Sharing

Copy URL Twitter E-mail

General

Target

129eab165ceea0ba8440422c7b775fcc
Size

24KB
MD5

129eab165ceea0ba8440422c7b775fcc
SHA1

2bf64cc0d112f6745d1cfedb4432283b21b7128f
SHA256

25838026dbfb8bec70ea0796581adf7794094a81317dfc939f33f65a0d2e2192
SHA512

432750cb764e9d3875d752c10a33eff48b0374833ec05c1e84acaf17f89b0d600503ef86642917b2904b0c5ef8937c08197f72fe4d95a48ded1896369acab9af
SSDEEP

96:dnWpeOVUcRrL3Cwskfm1DCI0Uav9hue3axU49Ew61:dnDOhRrLXoWU29ke/wA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
129eab165ceea0ba8440422c7b775fcc

Files

129eab165ceea0ba8440422c7b775fcc
.dll windows:4 windows x86 arch:x86

dff5217af9dadc9df25d9b6944482e30

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord4129
ord540
ord823
ord1168
ord2818
ord861
ord1253
ord342
ord941
ord858
ord5710
ord5683
ord5572
ord2915
ord800
ord537
ord1182

msvcrt

_initterm
_adjust_fdiv
_onexit
__dllonexit
wcscpy
_mbsicmp
malloc
free
__CxxFrameHandler

kernel32

GetModuleFileNameA
GetModuleHandleA
FlushInstructionCache
WriteProcessMemory
ReadProcessMemory
GetCurrentProcess
VirtualProtect
GetProcAddress

Sections

.text
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 883B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 776B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 550B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ