1447e45eda428fbcc5c6708029cbfaf1 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1447e45eda428fbcc5c6708029cbfaf1
Size

28KB
MD5

1447e45eda428fbcc5c6708029cbfaf1
SHA1

8dd5c2e7ce418c08b17c65f48027ae7aa28418df
SHA256

e9c9fb22898b5be74d1bb42a83f2ba5847ee6bb0b81a8ae6d1af464236651676
SHA512

cd01d6a099dddaac17ebe32523fcf4db44dfcd38831453e57dbce9fcf5da311af6ac90bb7a6ff8bff0ec8fd26a416de79ee4fff092a24c90b8eaec457acd363a
SSDEEP

384:cVE7cmgbSv5fmUfcr5zZsqTp2WvSI4qQvHHUwe8p:c7ls58twlqQfLe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1447e45eda428fbcc5c6708029cbfaf1

Files

1447e45eda428fbcc5c6708029cbfaf1
.dll windows:4 windows x86 arch:x86

98e1470a2108ffbb2907530e8938dcaa

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

ntohs
closesocket

msvcrt

malloc
_initterm
_itoa
free
strchr
memcmp
atoi
memcpy
??3@YAXPAX@Z
??2@YAPAXI@Z
strstr
fopen
fwrite
fclose
fread
time
memset
_strlwr
_adjust_fdiv

kernel32

Sleep
GetModuleHandleA
lstrlenA
LoadLibraryA
CopyFileA
GetProcAddress
GetModuleFileNameA
GetTempPathA
lstrcpyA
DeleteFileA
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory
CreateThread

Sections

.text
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 926B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 712B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ