39098d7345de096be992cfad0cfd0d60 | Triage

Sharing

General

Target

39098d7345de096be992cfad0cfd0d60
Size

16KB
MD5

39098d7345de096be992cfad0cfd0d60
SHA1

bf602121977aa8deaf0923116e0aeee5552835ab
SHA256

8fa13aa3c1d40e3211cb25f211c0e5db485ba2d0764044f089b32beec4b5b157
SHA512

26d4bbe88df4f7d1ccac186af11af169a54ec25312eb852acd4c00d91cba2f92a732695b702858b9d8c12a2be527b1e71e38a51e39183e8cb0fc9ff99aa01a8f
SSDEEP

384:iGmUaWKo7HZ38f3q2RQ+uBBQARQkKNnbt:iGFZsBaBBQARQk2b

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
39098d7345de096be992cfad0cfd0d60

Files

39098d7345de096be992cfad0cfd0d60
.dll windows:4 windows x86 arch:x86

6c47221602350c9cce0e438fb55e9c73

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

gethostname
closesocket

ntdll

memcmp
memcpy
strlen
strstr
RtlZeroMemory

kernel32

GlobalFree
CreateThread
lstrlenA
lstrcatA
VirtualProtectEx
lstrcmpA
OutputDebugStringA
lstrcpynA
lstrcpyA
lstrcmpiA
WaitForSingleObject
TerminateThread
Sleep
CloseHandle
CreateFileA
GetExitCodeThread
GetFileSize
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GlobalAlloc
ReadFile
LoadLibraryA
IsBadReadPtr

user32

CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
wsprintfA

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 626B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ