3800ae5198c766370633df8e58054fbd | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3800ae5198c766370633df8e58054fbd
Size

84KB
MD5

3800ae5198c766370633df8e58054fbd
SHA1

6ee515d4fecf65b157c86225e64097e65d1b5317
SHA256

54dcc3c19cda5727d157c0d2a31090379f020512c6fdbfd6ef309e9fff5e4639
SHA512

c9f90a7607dfc286fa07d80f4a095474de12aaed8fc5b6fc8d7a9f0e9cb3f841af88c50a2ebf2ad8758b955868be6ded35edb862077c05f8cecde55d05c7747e
SSDEEP

1536:3pZ/PaV/rtQiDkUVWCcZ0HdIZvUWhew90qe16Ff8tg:3HXaBxQiDkqyZ0uPhb0qe16FfGg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3800ae5198c766370633df8e58054fbd

Files

3800ae5198c766370633df8e58054fbd
.dll windows:4 windows x86 arch:x86

65abd7392341657a83019a4aea37278a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

EnumCalendarInfoA

user32

MessageBoxExA
CharPrevA
wsprintfA
MessageBoxA
CharNextA
LoadStringA

advapi32

InitializeSid
RegCloseKey
SetSecurityDescriptorDacl
AllocateAndInitializeSid
FreeSid
GetSecurityDescriptorDacl
RegEnumValueA
RegQueryValueExA
GetSidSubAuthority
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
RegOpenKeyExA
GetSidLengthRequired

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

shell32

SHGetMalloc
SHGetSpecialFolderLocation
SHGetPathFromIDListA

Exports

Exports

cwds

Sections

.text
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 450B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ