19a068a48b0d600821aae25406bd5f9f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

19a068a48b0d600821aae25406bd5f9f
Size

6KB
MD5

19a068a48b0d600821aae25406bd5f9f
SHA1

31e19f68dc9de5b6e0d9c0d3d260ef6626636a19
SHA256

f6e8bd12ea6a12cbc617b32ccec275569ca43fb9116a22a655cd02f25cac58cd
SHA512

903f957432c7b003ff9e2e821f9f9b2d6f83099c836bca3bf4d62c463e2399194485b41f3433f5f2f74e954827de9d13d6ec1c94e3673eee6b01c85aaa9ecc2e
SSDEEP

96:mZ5+dEVnjH2+p7bFE+xvPLhf0BDQrnUb/jczfapFKUafIPBu:WDT+wPLhf05QzVmCwBu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
19a068a48b0d600821aae25406bd5f9f

Files

19a068a48b0d600821aae25406bd5f9f
.dll windows:4 windows x86 arch:x86

38180f4679831eed22f1045d7df2a5ec

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MultiByteToWideChar
GetModuleFileNameA
WideCharToMultiByte
GetCurrentProcess
VirtualProtectEx
CreateThread

user32

CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA

msvcrt

_adjust_fdiv
strrchr
strcpy
memcpy
strlen
??3@YAXPAX@Z
??2@YAPAXI@Z
sprintf
strncpy
strchr
strstr
fclose
fread
fopen
memset
free
_initterm
malloc
_stricmp

wininet

InternetOpenUrlA
InternetOpenA
InternetCloseHandle
InternetReadFile

Exports

Exports

fa
fb

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 1002B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 404B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sdt
Size: 512B - Virtual size: 271B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 366B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ