3879c8fb7aa5e13906a8fc43d255950c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3879c8fb7aa5e13906a8fc43d255950c
Size

21KB
MD5

3879c8fb7aa5e13906a8fc43d255950c
SHA1

460b960363599f944fd5a8ed3bdc20187561f454
SHA256

845bd063c438d457e38e661b7c9e3ab622f584fc410069ba45b289ad04a5a64b
SHA512

0cafff489f89db43277669aadfa3cde13100ffca7d6f873f212d7a7b264a85a5a7245f30dbcfd481a22ec23491175cd1761ff6ee82c10a3fa4beb398e2041e04
SSDEEP

192:oa+ihPs5Yxm2z1UVuzAUQW8wcKvILoNVgbzRmVRMwnrSD+iY3r1lXHu31Wr7Glcr:bUSm2z1t8wx+kaK9J3r1FHu8z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3879c8fb7aa5e13906a8fc43d255950c

Files

3879c8fb7aa5e13906a8fc43d255950c
.dll windows:4 windows x86 arch:x86

c6f95d9d535837ba4a5307a3c50f7448

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

WSACleanup
WSAStartup
recv
closesocket
send
gethostbyname
htons
socket
connect

kernel32

CloseHandle
OpenEventA
SetEvent
VirtualQuery
CreateThread
GetTickCount
lstrcatA
lstrlenA
GetWindowsDirectoryA
GetSystemDirectoryA
lstrcmpiA
lstrcpyA
lstrcpynA
GetSystemTime
GlobalFree
GlobalAlloc
lstrcmpA
DeleteFileA
GetTempFileNameA
GetTempPathA
WinExec
GetModuleFileNameA
RtlUnwind
WriteFile
CreateFileA
CreateProcessA
GetLastError
FindFirstFileA
FileTimeToSystemTime
FindClose
GetComputerNameA
Sleep
CreateMutexA
ExitProcess

user32

SetWindowsHookExA
CallNextHookEx
SendMessageA
CharLowerA
wsprintfA

advapi32

RegCreateKeyA
RegQueryValueExA
RegCloseKey

Exports

Exports

Activate

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 522B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ