1c3af0ae13cbdecd29823458b56b0bfc | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1c3af0ae13cbdecd29823458b56b0bfc
Size

28KB
MD5

1c3af0ae13cbdecd29823458b56b0bfc
SHA1

7e0fa7f15beadd01ac82d758b68d5d0de092807e
SHA256

cd3092ab73ec5c33d107a67b9d732f5393618dcbdd34936172c6b093fcc5349e
SHA512

e3c42a212b216f1a47b902bbec62f56cabb61e2160b9aa7f17d88a06078543e3c596c43e1c5ac7b898ee4ec7d3210eb10d7009b4f661343c4a18d316b582b8e2
SSDEEP

384:RWLGoF6eGK9dvFXEJqCE9pvW8Bpct5or1LBMwTMP:aV59dd0Jqp91W8Bat5oxLBHTi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1c3af0ae13cbdecd29823458b56b0bfc

Files

1c3af0ae13cbdecd29823458b56b0bfc
.dll windows:4 windows x86 arch:x86

5ed61f8707adb48639566bf7c779ad71

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

GetWindowTextA
GetWindowThreadProcessId
EnumWindows

ws2_32

closesocket
ntohs

msvcrt

free
malloc
_adjust_fdiv
_itoa
strchr
srand
atoi
memcpy
??3@YAXPAX@Z
??2@YAPAXI@Z
strstr
fopen
fwrite
fclose
fread
time
memset
rand
_strlwr
_initterm

kernel32

Sleep
CreateThread
CreateEventA
WaitForSingleObject
GetTickCount
SetEvent
LoadLibraryA
CopyFileA
GetProcAddress
GetModuleFileNameA
GetTempPathA
lstrcmpA
lstrlenA
lstrcpyA
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory
GetModuleHandleA

Sections

.text
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ