1a835adbdb100342a9d8f0f120a8f5d0 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1a835adbdb100342a9d8f0f120a8f5d0
Size

24KB
MD5

1a835adbdb100342a9d8f0f120a8f5d0
SHA1

0d0f7b9489512215c205453d5a4e76c50200a1ab
SHA256

933ca8ff3bed3a3c99eafda23efbfd371a9882418fc208d2564ab8f4240e1ec8
SHA512

b300d886f357210a9cad0ac77677f763b9cae53681525af60d26119bcf144a207c4bce42deddf7d4277ec918948d92e11c0556d178a52ed78461aa321de6ac62
SSDEEP

192:CxMa8wee5ORXBKQDAZuytUovwrLfL1rapct5UrE+dU+m2:+kXPRKQDAZui4DL1rapct5ybdXm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1a835adbdb100342a9d8f0f120a8f5d0

Files

1a835adbdb100342a9d8f0f120a8f5d0
.dll windows:4 windows x86 arch:x86

d8a20cf8fc501d4451692f0ecdc7ba9f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

GetKeyState
GetKeyboardState
MapVirtualKeyA
VkKeyScanA
ToAscii
GetWindowTextA
EnableWindow
FindWindowA
FindWindowExA
EnumChildWindows

msvcrt

atoi
srand
free
_initterm
malloc
_itoa
rand
strchr
strstr
fopen
fwrite
fclose
fread
time
sprintf
??2@YAPAXI@Z
memset
memcpy
??3@YAXPAX@Z
_strlwr
strcmp
_adjust_fdiv

kernel32

GetTempPathA
lstrlenA
ExitProcess
GetTickCount
InitializeCriticalSection
LoadLibraryA
CopyFileA
GetProcAddress
GetModuleFileNameA
CreateThread
LeaveCriticalSection
OutputDebugStringA
lstrcpyA
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory
Sleep
lstrcmpA
EnterCriticalSection

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 794B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ