23cf7fa146497d2f1c4a262e6ed9eb68 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

23cf7fa146497d2f1c4a262e6ed9eb68
Size

12KB
MD5

23cf7fa146497d2f1c4a262e6ed9eb68
SHA1

56a1b210add763672d34791f9fbca694cc2e5dac
SHA256

d54dd3391b11f06efd9126266fb791dc5d11a556ffbeee45d6ba1b6cb68c0c6a
SHA512

088ce172c6617c12f97132a4cf6ca39a1fc483c35265f252206b924f7dc7159dbb894cc2f8daffbc1a8906749e5b76fadaa594f1a473742ceebb93e4c4a32afd
SSDEEP

192:fnsYMAoC2fhPE85zo1AsEJOM/VETvD1H4QL+SkuE76:fs2j85zgAxtNEF4QlE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
23cf7fa146497d2f1c4a262e6ed9eb68

Files

23cf7fa146497d2f1c4a262e6ed9eb68
.dll windows:4 windows x86 arch:x86

efe828a2ff23f16901afc3dd9dfca5fe

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

OutputDebugStringA
VirtualProtect
Sleep
lstrcatA
lstrcpyA
lstrcmpA
ExitProcess
lstrcmpiA
lstrlenA
GetTickCount
lstrcpynA
WritePrivateProfileStringA
GetTempPathA
GetPrivateProfileStringA
GetModuleFileNameA
GetModuleHandleA
CloseHandle
ReadFile
SetFilePointer
CreateFileA
CreateThread
UnmapViewOfFile
LoadLibraryA
MapViewOfFile
OpenFileMappingA
GetLastError
CreateMutexA

user32

SetWindowsHookExA
UnhookWindowsHookEx
PostThreadMessageA
CallNextHookEx

wininet

InternetCloseHandle
InternetReadFile
HttpQueryInfoA
InternetOpenUrlA
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
InternetConnectA

Exports

Exports

Hookoff
Hookon

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ