3773636259026b32e6ce97605cc92a69 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3773636259026b32e6ce97605cc92a69
Size

7KB
MD5

3773636259026b32e6ce97605cc92a69
SHA1

99faafc124510091448f064fcaab6d28b432bd45
SHA256

5ff0eba289289fd8e09aa6cdeb6d49160364e95ea7ce5b97a22f1642f1bab1f9
SHA512

680a7d517bfce9c2793cb186e7acea91926d462f4cef8c45ce1b1d0f321550161fb4c36422979ccbe77df9afad542d39bd6dec77873f100a99d71e33ea218582
SSDEEP

96:HOMRb4A84nmmzGljuiEFTXZGg8hzoGOLEafhOaMba:uOb4A8iOqFNUvhzqLLvMb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3773636259026b32e6ce97605cc92a69

Files

3773636259026b32e6ce97605cc92a69
.dll windows:4 windows x86 arch:x86

af1186ead1cc5a71f7bc4452086ae8f2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

Sleep
VirtualProtectEx
GlobalFree
IsBadReadPtr
GlobalLock
GlobalAlloc
GetCurrentProcess
CreateThread
GetModuleFileNameA
ReadProcessMemory

user32

EnumChildWindows
GetClassNameA
IsWindowVisible
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
SendMessageA
FindWindowA
FindWindowExA

wininet

InternetCloseHandle
InternetOpenUrlA
InternetOpenA
InternetReadFile

msvcrt

strrchr
_adjust_fdiv
malloc
_initterm
free
memcpy
??3@YAXPAX@Z
strcmp
strlen
??2@YAPAXI@Z
sprintf
strcpy
_stricmp

Exports

Exports

fa
fc

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sdt
Size: 512B - Virtual size: 271B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 474B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ