2bd5dee26d3a848fc5a930f0662722ff | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2bd5dee26d3a848fc5a930f0662722ff
Size

19KB
MD5

2bd5dee26d3a848fc5a930f0662722ff
SHA1

1fad13a8709c9b06e8e866b204fa8a4e370f8134
SHA256

1d3f5b7134d4d5ef9c221bce4dd40e9212188ffde753c87eb6c0bd4cd43c0c95
SHA512

dcdad5064754d9dd025fb24d4c4c33bd093b1ec59e5c4c9cb53ab30cde0aa13b02f3b0a450d309240acd813504895bfda72c1d94acf0e09c90dde6d245c662d4
SSDEEP

192:6EpW3GoKNg5sMwi18HGgkJN15HRFKFr5WyZjI1TFJGGJtN5X6ZhLu:jWWoKNg1wi8H4Tvx+5jjcpFC0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2bd5dee26d3a848fc5a930f0662722ff

Files

2bd5dee26d3a848fc5a930f0662722ff
.dll windows:4 windows x86 arch:x86

2045706bac778201702fe46161ffb3a2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

socket
connect
bind
recvfrom
listen
accept
WSAStartup
gethostbyname
send
htons
sendto
closesocket
select
__WSAFDIsSet
recv

wininet

InternetConnectA
InternetGetConnectedStateEx
InternetOpenA
InternetOpenUrlA
InternetCloseHandle
InternetReadFile
FtpPutFileA

urlmon

URLDownloadToFileA

kernel32

ExitProcess
WinExec
GetWindowsDirectoryA
lstrcatA
CreateThread
Sleep
lstrcmpA
lstrlenA
lstrcpyA
CreateFileA
ReadFile
SetFilePointer
WriteFile
CloseHandle
GetFileSize
GlobalAlloc
GlobalFree

user32

CharLowerBuffA

advapi32

RegQueryInfoKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ