3a444dcd0b8dcf8e14f51d4879646c5e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3a444dcd0b8dcf8e14f51d4879646c5e
Size

121KB
MD5

3a444dcd0b8dcf8e14f51d4879646c5e
SHA1

6c73ebc805caf3cdcaffdd0dc91df64971945c17
SHA256

f272db068826cdbd7c4df8a9852e17bb225e4c473630f67693a03c7422ece6e7
SHA512

709c984cced7a83052520bfc380a26f311f4654b032294973e0cbc1379fc3bae78a0c37ccdff5c3d143b79ae45ce47e8fa392ac1e629f417429f429a66c6a989
SSDEEP

3072:2K0eRoYNSTG1o/ZRof7oQjXT/Vk7gY5DNxX5DQQyfKjdt9t:Z0eRwRof7oQrT/SkuDNxt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3a444dcd0b8dcf8e14f51d4879646c5e

Files

3a444dcd0b8dcf8e14f51d4879646c5e
.dll windows:4 windows x86 arch:x86

bb63ab0f5cf695e2e95e60732ad6e1b3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

IsBadReadPtr
GetModuleHandleA
lstrcpyW
lstrlenA
VirtualProtect
GetCurrentProcessId
lstrcpyA
lstrcpynA
lstrcatA

user32

wsprintfA

msvcrt

_onexit
__dllonexit
getc
putc
memchr
memcmp
strstr
memmove
memcpy
memset
strtoul
strlen
_EH_prolog
??3@YAXPAX@Z
??2@YAPAXI@Z
__CxxFrameHandler

msvcp60

?_Xlen@std@@YAXXZ
?_Xran@std@@YAXXZ

Sections

.text
Size: 98KB - Virtual size: 98KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ