19a5c66b8bd20ca061f3f3c8cd5952eb | Triage

Sharing

General

Target

19a5c66b8bd20ca061f3f3c8cd5952eb
Size

19KB
MD5

19a5c66b8bd20ca061f3f3c8cd5952eb
SHA1

4d9598d4535bc6693f99b796f6b2dbdbe0b93a2f
SHA256

eb0a1db05cd18a91fe1e116921685fb16d91164427c8723e2344a4e9490775af
SHA512

a5745d56d6d9c7c90930054e472f450e96dc26a66527088060f54bc876698e73d11e3a74b04223676d794fc02850502c0a80be3a51facd6aa87c54f74048708d
SSDEEP

192:ktVb2GRzyb8msduiQm3g0UATs7dHfuBEEnzRvg5gMnRQ0YSu93r4lXvWdkt:sViv4mRI5sdWtzyK3r4F

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
19a5c66b8bd20ca061f3f3c8cd5952eb

Files

19a5c66b8bd20ca061f3f3c8cd5952eb
.dll windows:4 windows x86 arch:x86

cf51304fec517cf85c3097e04f82ff7d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

WSACleanup
WSAStartup
recv
closesocket
send
gethostbyname
htons
socket
connect

kernel32

GetModuleFileNameA
OpenEventA
SetEvent
VirtualQuery
CreateThread
GetTickCount
lstrcatA
lstrlenA
GetWindowsDirectoryA
GetSystemDirectoryA
lstrcmpiA
lstrcpyA
lstrcpynA
GetSystemTime
Sleep
GlobalFree
GlobalAlloc
lstrcmpA
DeleteFileA
GetTempFileNameA
GetTempPathA
WinExec
RtlUnwind
CloseHandle
WriteFile
CreateFileA
CreateProcessA
GetLastError
FileTimeToSystemTime
FindClose
FindFirstFileA
GetComputerNameA
CreateMutexA
ExitProcess

user32

SetWindowsHookExA
CallNextHookEx
SendMessageA
CharLowerA
wsprintfA

advapi32

RegCreateKeyA
RegQueryValueExA
RegCloseKey

Exports

Exports

Activate

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 554B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ