2cc46166fc447740e81b9a65d014311e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2cc46166fc447740e81b9a65d014311e
Size

14KB
MD5

2cc46166fc447740e81b9a65d014311e
SHA1

6ab721a4e141fdf342493d3eaab35f31e19f8785
SHA256

bfa1dbeb264c6c1f344a15270ba73bcde6c29a7d6ad31b92251323c86928f5f5
SHA512

71c16d4b204812f16194352aba92e2b86fbf15c95b786bad2412787cb23c294cc6d3bf6d188c49760b3f434ccd480d6319b61241461a326c8143e519a3337f03
SSDEEP

192:EAtvrdYjwqBsdHH9zBOIPkRXfPacdgE95el3cALlIpR5cXtRnghopYjcHVYh0U3b:DtKj9MHfcRP46ZcdRghonYh0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2cc46166fc447740e81b9a65d014311e

Files

2cc46166fc447740e81b9a65d014311e
.dll windows:4 windows x86 arch:x86

ebaf7a75997896145398d8bb6f0a9f66

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

AttachThreadInput
OpenIcon
EnableScrollBar
ChildWindowFromPointEx
CallMsgFilterA
RegisterClassA

kernel32

GetModuleHandleW
lstrcpyA
Sleep
CallNamedPipeA
CloseHandle
CreateFileA
DeleteFileA
DeviceIoControl
ExitProcess
LoadLibraryExA
PeekConsoleInputA

ws2_32

gethostbyname
recv
setsockopt
socket
WSASocketA

ntdll

RtlGetProcessHeaps
NtWaitLowEventPair
NtQuerySemaphore
NtPrivilegeCheck
NtAllocateLocallyUniqueId

Exports

Exports

osrbolt

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 886B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

CSEG
Size: 1024B - Virtual size: 814B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 264B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 988B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ