267861d74226dcb629436ecacccab0aa | Triage

Sharing

Copy URL Twitter E-mail

General

Target

267861d74226dcb629436ecacccab0aa
Size

11KB
MD5

267861d74226dcb629436ecacccab0aa
SHA1

e435674f2c390ecc0acb199498053a98e34ee807
SHA256

1289f707b35b861cf76c7d2c3f70639bb0cd4072316722951db3bf71a521a5a0
SHA512

ba02e29d0912c60789d1c250244a64cef8451027e8100952e4d7f62ad3de21f0194130563ac5e0f3f5edd6a6c3dd02bc5b796dc0c1314187dfd446f47ddcba25
SSDEEP

192:uZE2beBiPf5T/yNShReIW6KXIG4EUISi1bUZETwOdf+LZ:sbe4P1eUe/6cIGy4wM+L

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
267861d74226dcb629436ecacccab0aa

Files

267861d74226dcb629436ecacccab0aa
.dll .vbs windows:4 windows x86 arch:x86 polyglot

a286d5eb3d7f27c43facf94acc1776de

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord389
ord540
ord1228
ord3229
ord5204
ord5808
ord800
ord690
ord1182
ord823
ord342
ord1168
ord1253

msvcrt

??1type_info@@UAE@XZ
??3@YAXPAX@Z
strcmp
strncmp
atoi
_EH_prolog
__CxxFrameHandler
strstr
memcpy
memset
strlen
fread
printf
fputs
fclose
time
srand
rand
fopen
sprintf
strcat
strcpy
_strnicmp

kernel32

GetDriveTypeA
GetLogicalDrives
GetVolumeInformationA
SetFileAttributesA
MoveFileA
GetFileAttributesA
lstrcatA
lstrcpyA
Sleep
CopyFileA
CreateDirectoryA
CloseHandle
ReleaseMutex
WriteFile
PeekNamedPipe
ReadFile
CreatePipe
CreateProcessA
GetExitCodeThread
TerminateProcess
GetSystemDirectoryA
CreateMutexA
WaitForSingleObject
CreateThread
DeleteFileA

ws2_32

htons
inet_addr
closesocket
recv
setsockopt
getsockopt
send
connect
socket
WSAStartup

Sections

.data
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 622B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ