17ffad7c60d1c8c6750a7fcdadfae982 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

17ffad7c60d1c8c6750a7fcdadfae982
Size

28KB
MD5

17ffad7c60d1c8c6750a7fcdadfae982
SHA1

57b7666b2f8b0ee214b0696bfb9d698544e71d19
SHA256

0828bd1bf7cd888c4dd35c2c30b34f956e641d5bbc2cc54324161b4ba1241141
SHA512

e0e1f11c8b2742875aacf3722a04ca46c30b74137403b97667b6a3ecf7f575002be8c4b94481a65735d83575b64745bbfbc1ff13479cadfadc2142ef884bafe7
SSDEEP

384:BCVP3xpwEAgWAZXvJkp9M9kByM9aeHjvAYXCpct5p95:uvA/ZAZRkpe9kJ9aeHj4YXCat5d

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
17ffad7c60d1c8c6750a7fcdadfae982

Files

17ffad7c60d1c8c6750a7fcdadfae982
.dll windows:4 windows x86 arch:x86

cd1a288f25db225e71713fc9268a55d7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

inet_addr

msvcrt

_strlwr
_adjust_fdiv
malloc
_initterm
free
strcat
strlen
atoi
memcpy
strstr
??3@YAXPAX@Z
??2@YAPAXI@Z
memset

kernel32

VirtualProtectEx
TerminateProcess
lstrcpyA
GetModuleHandleA
CreateThread
LoadLibraryA
GetTempPathA
CopyFileA
GetProcAddress
GetModuleFileNameA
lstrlenA
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
WriteProcessMemory
Sleep

Sections

.text
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 824B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 782B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ