3aa0a2b2afd8958876f799bd03307fa9 | Triage

Sharing

General

Target

3aa0a2b2afd8958876f799bd03307fa9
Size

8KB
MD5

3aa0a2b2afd8958876f799bd03307fa9
SHA1

683302ef2eb3f3af4fd11c2ecf0f6acb53ee775f
SHA256

a2229633a849c2931aeff5db03229846dacf91bf6b2413315ee9fae83d427ae8
SHA512

fec43b66a7720aac0ebcff169d11325b4129084f5e2678089501d904971e469d3cf3d9073e449f570fce6c18c47851f5067d1373a128d601c97ea9fdd635f129
SSDEEP

192:eQ4aakuWrEZ/KftYIgpHdgEYgkViqlIiyacqIZ06pd2dl:X4aawEs1YIQ9q8ioZ06pEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3aa0a2b2afd8958876f799bd03307fa9

Files

3aa0a2b2afd8958876f799bd03307fa9
.dll windows:4 windows x86 arch:x86

6fc9e5246dbc984ce48a5ea0cd212d17

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

ZwLoadDriver
RtlImageNtHeader
atol
RtlAdjustPrivilege
strchr
RtlInitUnicodeString
ZwFlushInstructionCache
ZwCreateEvent
mbstowcs
_stricmp
_snprintf
sprintf
memcpy
_chkstk

kernel32

CreateDirectoryA
GetLastError
InterlockedExchange
GetProcAddress
LocalAlloc
CreateThread
GetTempPathA
WinExec
VirtualProtect
LoadLibraryExA
GetModuleHandleA
GetModuleFileNameA
LoadLibraryA
VirtualQuery
VirtualFree
GetVolumeInformationA
Sleep
VirtualAlloc
GetVersionExA
CreateFileA
GetLogicalDrives
WriteFile
GetTempFileNameA
CopyFileA
SetFileAttributesA
CloseHandle
MoveFileExA
FreeLibrary
GetTickCount
RaiseException

Sections

.text
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 140B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 342B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ