167a62366d14bc3101e1ed4d25e8250b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

167a62366d14bc3101e1ed4d25e8250b
Size

28KB
MD5

167a62366d14bc3101e1ed4d25e8250b
SHA1

2036025a27489e8d4c2b2fe2b25729594d5dff61
SHA256

17e9cb7a700c16fcbbb6ac551827c2afaad0d3f2f622c8881ebdb4085494a4a9
SHA512

66966a760818615803bb535b58f8d5d1f4d0b7f2e01bebe155e02ee23e747b54cd50e97ab6a9da8536c633605a81f78d84d209ddd80fc6683030ed2b15fcca5b
SSDEEP

384:nesBWewqXdnnFBOMeYGtQbdwsWqfu2fNquwdwzFf7GjqojDXM85ZQ:esBVLtnnNqQJJTf/f4H+fqqojDXr5O

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
167a62366d14bc3101e1ed4d25e8250b

Files

167a62366d14bc3101e1ed4d25e8250b
.dll windows:4 windows x86 arch:x86

cdbb0fe8ae53d6df1587ff4776b627bc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

ToAscii
GetWindowTextA
EnableWindow
FindWindowA
FindWindowExA
EnumChildWindows

msvcrt

_adjust_fdiv
_itoa
_initterm
free
srand
memcmp
strrchr
atoi
rand
strchr
strcmp
strcpy
strstr
fopen
fwrite
fclose
fread
time
??2@YAPAXI@Z
memset
memcpy
??3@YAXPAX@Z
_strlwr
malloc

kernel32

DeleteFileA
CreateThread
ExitProcess
GetTickCount
GetModuleHandleA
InitializeCriticalSection
GetTempPathA
EnterCriticalSection
lstrlenA
LeaveCriticalSection
lstrcpyA
GetModuleFileNameA
LoadLibraryA
GetProcAddress
VirtualAllocEx
WriteProcessMemory
GlobalAlloc
GlobalLock
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
Sleep
lstrcmpA
CopyFileA

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ