2913521ec7a820fbcb32a5581003ab92 | Triage

Sharing

General

Target

2913521ec7a820fbcb32a5581003ab92
Size

9KB
MD5

2913521ec7a820fbcb32a5581003ab92
SHA1

f4a9a6e1183f0664481524db92e01b7c33f5f609
SHA256

03f3fd8646c5d8e7daa46e9e56d25e6ae547f16bd2498b6a2356e46f7004e425
SHA512

b1aba7b13e0296f368160d38141e4fb2cc777e9674528ae0e2a1e852a57c0267bfe52db77ed4e5fbfbc8e25de98b8e6fcb57f2b696c3ab757433b2c755f34bed
SSDEEP

192:YtR3o34EM4kHkqcg7DSz7iw8gJwHma28:YtR3o34CkHkqcgi0gJwHmV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2913521ec7a820fbcb32a5581003ab92

Files

2913521ec7a820fbcb32a5581003ab92
.dll windows:4 windows x86 arch:x86

2e7699d5119b3c4d1049b968dd22e605

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WriteProcessMemory
ReadProcessMemory
ExitProcess
GlobalFree
GetComputerNameA
GlobalLock
GlobalAlloc
IsBadReadPtr
CreateThread
GetModuleFileNameA
GetCurrentProcessId
Sleep
GetCurrentProcess
GlobalUnlock

user32

FindWindowA
GetWindowTextA
CallNextHookEx
SetWindowsHookExA
GetWindowThreadProcessId

wininet

InternetOpenUrlA
InternetOpenA
InternetCloseHandle

msvcrt

strcmp
_adjust_fdiv
malloc
_initterm
free
fopen
fread
strlen
strrchr
??3@YAXPAX@Z
memset
??2@YAPAXI@Z
sprintf
_stricmp
strcpy
strncpy
strchr
memcpy
fclose

Exports

Exports

fa

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 604B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sdat
Size: 512B - Virtual size: 269B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 666B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ