36bd89f6ff5d019822c75a541117d7e4 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

36bd89f6ff5d019822c75a541117d7e4
Size

117KB
MD5

36bd89f6ff5d019822c75a541117d7e4
SHA1

160767b928d36ddfcc9865d3648983b333b5ebef
SHA256

53a685cd8eb70cdaa4fdd3663f19633678a95dbd844dec6c10e417fda1075338
SHA512

a5d4445e53030cf4f1c557e2bbf295f64f518ba78e798766fd1d759272fc8fa28040339dc30a4b81bf61e8191f75653a7ecd968c84d3072cf2717f8dbe140cce
SSDEEP

1536:qkXt8YSIIBcx0oIQm2BYM6vX/+M94XLGjh/ktodXMp/wAQyJTFhlYIpNieV47Tzw:qK8AKcx1PmSYM6vXI0s44Q8lNNids

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
36bd89f6ff5d019822c75a541117d7e4

Files

36bd89f6ff5d019822c75a541117d7e4
.dll windows:4 windows x86 arch:x86

d487756ddd88d69fbb031a1e0b52417d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

HeapAlloc
GetProcessHeap
GetTickCount
GetStartupInfoA
HeapFree

dbghelp

SymFunctionTableAccess
SymGetModuleInfoW
SymInitialize
SymSetSearchPath
SymEnumerateSymbolsW
StackWalk
SymGetSymFromAddr
SymLoadModule
SymGetModuleInfo

Exports

Exports

_KLTLGE@0

Sections

.text
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ