40eae85d6934aec4a16b3d920fbb8f7b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

40eae85d6934aec4a16b3d920fbb8f7b
Size

24KB
MD5

40eae85d6934aec4a16b3d920fbb8f7b
SHA1

434b57f12e85ba655622e624e529e4d6aacc007d
SHA256

445acb37c8eec38932cae38f71481e10c0c6b73c8de7e25a8f16718bbcf43bdc
SHA512

831c4a5cd78cd98860b57c164450c5c1f72caa081b5020fd65acf18d96e142bfc18ac2ebcf4116ce5e1e71344e6e3424eefdf6e7fb8761f6106ef00c2fbbb9cc
SSDEEP

384:/9+NXQMBivG/RCcYymr4KSpct5LooaZvb:/9bKx/RCcYymr4dat5paZv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
40eae85d6934aec4a16b3d920fbb8f7b

Files

40eae85d6934aec4a16b3d920fbb8f7b
.dll windows:4 windows x86 arch:x86

d4c6718d56bdc5d19b067282ce7b9d97

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

closesocket
ntohs
ntohl

msvcrt

free
_initterm
strchr
_adjust_fdiv
_itoa
atoi
memcpy
strncpy
strcmp
sprintf
??3@YAXPAX@Z
??2@YAPAXI@Z
strstr
fopen
fwrite
fclose
fread
time
memset
_strlwr
malloc

kernel32

Sleep
GetCommandLineA
ExitProcess
GetModuleHandleA
LoadLibraryA
CopyFileA
GetProcAddress
GetModuleFileNameA
GetTempPathA
lstrlenA
lstrcpyA
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory
CreateThread

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 996B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 726B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ