3e4dcaa021f867f454002e13e254cee4 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3e4dcaa021f867f454002e13e254cee4
Size

19KB
MD5

3e4dcaa021f867f454002e13e254cee4
SHA1

835c27e32d38b2be29bea1fa5e65946426923370
SHA256

0cd4bd92f565f645cd845fcb59150343e3b90b820d6d157ebb079aed4bdf380a
SHA512

1a0e1cb47d1645ce15b3bf55dd1c350c43dcbe2b314b58d9e9505e28c063840b457470f499a7f356c37b036be729850c51754cbb29ce0b8cb20cb83011e6be59
SSDEEP

384:g/Wg/7ZdOhIb33Z1qct34B65KdBG8lc7APgDzZzZJN4ze+lL4XeF4:cpTii3HKflc7rDt/N4KKMeF4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3e4dcaa021f867f454002e13e254cee4

Files

3e4dcaa021f867f454002e13e254cee4
.dll windows:4 windows x86 arch:x86

381812fa1f03c2834d984516e120035d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shell32

ShellExecuteA

advapi32

RegSetValueExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA

msvcrt

rand
memcpy
strtok
malloc
strlen
srand
memset
atoi

urlmon

URLDownloadToFileA

kernel32

lstrcpynA
lstrlenA
lstrcpyA
lstrcmpA
lstrcatA
Sleep
TerminateThread
CreateThread
ExitThread
GetLastError
GetModuleFileNameA
GetTickCount
GetVersionExA

wininet

HttpOpenRequestA
InternetConnectA
InternetOpenA
HttpSendRequestA
InternetCloseHandle

ntdll

_chkstk

user32

GetDesktopWindow
wsprintfA

ws2_32

closesocket
connect
gethostbyname
gethostname
inet_ntoa
WSAStartup
send
sendto
setsockopt
socket
WSAConnect
inet_addr
htons
accept
listen
bind
select
__WSAFDIsSet
recv
WSASocketA

Exports

Exports

TestProc

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ