37b88fed2be8c8017944a9e43695d856 | Triage

Sharing

General

Target

37b88fed2be8c8017944a9e43695d856
Size

24KB
MD5

37b88fed2be8c8017944a9e43695d856
SHA1

0c5b85644b967e16b5afa676afe1426f5b0e86a8
SHA256

d35eb91f91f910e7301a01f29bf13fffad9966951973be97ed4cd5989a258e5c
SHA512

f90efb24e83b70d7b40f9e9effc3410639eede5848a0c8ee95ff0ebd858a2d418a00b1eaaeee6394dfee9e16929bc34f1625f629097b4c1ceca3858b495a8b40
SSDEEP

384:19DaHwVRz5gvOqZL+W/1E+ipct5YmV+tMdSx:yw/WvXLtq5at57+tMdSx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
37b88fed2be8c8017944a9e43695d856

Files

37b88fed2be8c8017944a9e43695d856
.dll windows:4 windows x86 arch:x86

69176ab96077599c5822aa692864769f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

GetWindowTextA
EnableWindow
FindWindowA
FindWindowExA
EnumChildWindows

msvcrt

free
strchr
malloc
_adjust_fdiv
_strlwr
atoi
memcpy
strcmp
??3@YAXPAX@Z
??2@YAPAXI@Z
strstr
fopen
fwrite
fclose
fread
time
memset
_itoa
_initterm

kernel32

CopyFileA
GetModuleFileNameA
ExitProcess
lstrlenA
LoadLibraryA
CreateThread
GetTempPathA
IsBadReadPtr
lstrcpyA
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory
Sleep
lstrcmpA
GetProcAddress

Sections

.text
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 624B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ