3b3e5575bf2dfdbe71182f5944deaa57 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3b3e5575bf2dfdbe71182f5944deaa57
Size

24KB
MD5

3b3e5575bf2dfdbe71182f5944deaa57
SHA1

084170e1f5886062910f7b2956f66797eba5b478
SHA256

5fd560734e1f336e23a5a8dbdd83836ab0e37b099f71800cded7ba7accb1f505
SHA512

f5a46e201bba6bba8a57f52b29ea737626cddd03713f0bf6efdf2a3a148a37d77e264cb8e749a6bb7f0b5ef2cb53dd616e2d5634429648e6340487696f0683bf
SSDEEP

384:f89ySeszQr2dRWRFBwJr4KSpct5LooaZvL:E9x0r2DWRFBwJr4dat5paZv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3b3e5575bf2dfdbe71182f5944deaa57

Files

3b3e5575bf2dfdbe71182f5944deaa57
.dll windows:4 windows x86 arch:x86

d4c6718d56bdc5d19b067282ce7b9d97

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

closesocket
ntohs
ntohl

msvcrt

free
_initterm
strchr
_adjust_fdiv
_itoa
atoi
memcpy
strncpy
strcmp
sprintf
??3@YAXPAX@Z
??2@YAPAXI@Z
strstr
fopen
fwrite
fclose
fread
time
memset
_strlwr
malloc

kernel32

Sleep
GetCommandLineA
ExitProcess
GetModuleHandleA
LoadLibraryA
CopyFileA
GetProcAddress
GetModuleFileNameA
GetTempPathA
lstrlenA
lstrcpyA
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory
CreateThread

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 996B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 726B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ