1a3ef4267f301644fa2c4fc46fa3a084 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1a3ef4267f301644fa2c4fc46fa3a084
Size

11KB
MD5

1a3ef4267f301644fa2c4fc46fa3a084
SHA1

3ba60a9e05dc6ebd9d9a02d89ece6b99042fcbab
SHA256

2a238ebe31386c849ae2d368fd1bd87c04fbc3b016d81464c64251adb2cf46db
SHA512

f2826d43ec1c1862e62b1c05df119849d9392cdae51f0d2bb97c924a9fc1e3a5e7cf985d93803f2221d2e0c6698cd52c283e09258880eac65f13f7e1d68a8834
SSDEEP

192:m0bt5Ivt2hxhJBkoV3awtFkdqtYgyneYfknW4nrS4Qt3GnMkuokSkpmTME0h:Tbt5ut2hxhrnawnk4t4z8W4nO3Pr1S50

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1a3ef4267f301644fa2c4fc46fa3a084

Files

1a3ef4267f301644fa2c4fc46fa3a084
.dll windows:4 windows x86 arch:x86

b5a86134ae063e631b01a270ad195a34

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

HeapAlloc
GetProcessHeap
VirtualProtect
CloseHandle
WriteFile
SetFilePointer
CreateFileA
CompareStringA
IsBadReadPtr
LoadLibraryA
GetModuleHandleA
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
GetProcAddress
OpenProcess
lstrlenA
CreateThread
GetCurrentProcess
FreeLibrary
GetModuleFileNameA

user32

wvsprintfA
wsprintfA
GetWindowThreadProcessId
FindWindowA
SetTimer
KillTimer
DispatchMessageA
TranslateMessage
GetMessageA

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken

wininet

InternetCloseHandle
InternetReadFile
InternetOpenUrlA
InternetOpenA

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 642B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ