406477ff6451eca7cedf4260fb18911b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

406477ff6451eca7cedf4260fb18911b
Size

32KB
MD5

406477ff6451eca7cedf4260fb18911b
SHA1

203dc8fb0f2e69c348e86c00dde7d011c0621970
SHA256

399a25a99c933bb93859af3dad77de33bb5e1a153d8e95f5e1ef2aafe923712f
SHA512

08ab510c1846fa5e9adbece8aa90b02653e4490069d80c797b2fd9121fcb20924af6109d1e20e342f7f3a9d1e3cdaef71d971b98a7e4782524f05a2667719062
SSDEEP

384:gq0sIC9jvV6F5O3Hs8MV5dRT5T+35omlATiQcxv/fm5:vmWDQFAXs8MVHRT5T+JomlATiQO/fK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
406477ff6451eca7cedf4260fb18911b

Files

406477ff6451eca7cedf4260fb18911b
.dll windows:4 windows x86 arch:x86

b9b326b46fa4dd73ea78e66fada837f4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

ntohs
closesocket

msvcrt

atoi
memcmp
free
_initterm
memcpy
_adjust_fdiv
_itoa
strcmp
strstr
strrchr
fseek
ftell
??2@YAPAXI@Z
strchr
strncpy
??3@YAXPAX@Z
fopen
fread
fclose
fwrite
time
memset
_strupr
_strlwr
malloc

kernel32

Sleep
GetModuleHandleA
CopyFileA
LoadLibraryA
GetProcAddress
GetTempPathA
CreateThread
SetEvent
WaitForSingleObject
lstrlenA
lstrcpyA
ReadProcessMemory
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
GetModuleFileNameA
lstrcatA
CreateEventA

Sections

.text
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ