18080e996df8fe760e35f5f2ae850e3b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

18080e996df8fe760e35f5f2ae850e3b
Size

189KB
MD5

18080e996df8fe760e35f5f2ae850e3b
SHA1

f67fcdca8319853e194c609df4dcf4b1e4c697b8
SHA256

e1f9adc70e78d32c1a3f7482f06a0528fa5e0def4039d5e47554dd072cdd941c
SHA512

4943def95f15ba251b08ce2baf35454c1563280b15daa742ba19f0e1050b1b7e9e36bb8a07c4bc9005e3e7d8b8a8ceda1bc4e76f6089cebd6fb0bdc6c52cf053
SSDEEP

3072:lAtCxjKayZsQjjrw4evdTgE2Azw6bJro9FBJxcySvD3m7zmn6qm8AR9z7OV3:Thnb/gE2Azfb1o9F/ayoDkTu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
18080e996df8fe760e35f5f2ae850e3b

Files

18080e996df8fe760e35f5f2ae850e3b
.dll windows:4 windows x86 arch:x86

edba15d94b8d026b792dba2dc58eef0a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

wsprintfA

gdi32

DeleteObject

advapi32

OpenProcessToken

shell32

ShellExecuteA

ws2_32

getpeername

psapi

EnumProcessModules

iphlpapi

GetAdaptersInfo

version

GetFileVersionInfoSizeA

shlwapi

PathIsDirectoryA

winmm

timeGetTime

Exports

Exports

loadllah

Sections

.text
Size: 181KB - Virtual size: 668KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE