28af774f842b2fcfa5a9d83a20ff10af | Triage

Sharing

Copy URL Twitter E-mail

General

Target

28af774f842b2fcfa5a9d83a20ff10af
Size

24KB
MD5

28af774f842b2fcfa5a9d83a20ff10af
SHA1

712137f9c07d3b40be6de40ea6806fb132c01b70
SHA256

a592d6060e0c45df3ac502935351562b509fed623db562a19207f7c0cd3c88e7
SHA512

9ad8894e99750333b50f373edcb2cb9cb06a5e83e05b10895917bd2c2fc40162ad56a849c560a8e88d318c6d1cd9cea265a95707b863faebb8dabf98e52de2cc
SSDEEP

192:s6BcKUsbKsKsGKa9KE+KQKZKCKz2UZca5J1ju1WXAW9KketfIT9:9BrcsZcaRjuyAW9KdI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
28af774f842b2fcfa5a9d83a20ff10af

Files

28af774f842b2fcfa5a9d83a20ff10af
.dll windows:4 windows x86 arch:x86

2e9980076d9d5a47d9b3b66368618349

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord1168

msvcrt

_adjust_fdiv
malloc
_initterm
free
exit
_stricmp

kernel32

ExitProcess
GetLastError
CreateThread
DeleteFileA
WinExec
GetSystemDirectoryA
GetProcAddress
LoadLibraryA
Sleep
GetCurrentProcessId
Process32First
CreateToolhelp32Snapshot
lstrcmpiA
TerminateProcess
OpenProcess
CreateMutexA
Process32Next

advapi32

RegOpenKeyA
RegCreateKeyA
CreateServiceA
DeleteService
StartServiceA
OpenSCManagerA
OpenServiceA
ControlService
CloseServiceHandle
RegSetValueExA
RegCloseKey

Sections

.text
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 472B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ