419493274d8037f7f5373bae95c78adc | Triage

Sharing

Copy URL Twitter E-mail

General

Target

419493274d8037f7f5373bae95c78adc
Size

7KB
MD5

419493274d8037f7f5373bae95c78adc
SHA1

9db90d0fc9d17b79a928af09e6ed3fa162b9c4f8
SHA256

2138f07bcd2bebd6f9de8a4a7792156accc004c097c081e0553eda25ebe5824f
SHA512

4c86e6833c539a5bc10cbe6618c703c02c352b8f37b1f4200689624f3731cb860584e3fd139cce956005682fb8c428d16636353597947a51b5375ce97cb98eaa
SSDEEP

96:eQlQDl/+cwizAIVI1nm6EjpxauYLgRVL8+On83DhFPyuzlAfxkyVDjKMYEvxkLIH:eQlC/4ujOuqgRpFO83D3LAPxAjI706pj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
419493274d8037f7f5373bae95c78adc

Files

419493274d8037f7f5373bae95c78adc
.dll windows:4 windows x86 arch:x86

17b1c8d50b732bf269363bd2277d1f4a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

RtlImageNtHeader
atol
strchr
ZwCreateEvent
_stricmp
_snprintf
sprintf
memcpy

kernel32

SetFileAttributesA
LoadLibraryA
GetLastError
InterlockedExchange
GetProcAddress
LocalAlloc
CreateThread
GetTempPathA
VirtualQuery
VirtualFree
GetVolumeInformationA
Sleep
VirtualAlloc
GetVersionExA
CreateFileA
GetLogicalDrives
WriteFile
CreateDirectoryA
CopyFileA
RaiseException
CloseHandle
MoveFileExA
FreeLibrary
GetTickCount
GetTempFileNameA
GetModuleFileNameA
GetModuleHandleA
LoadLibraryExA
VirtualProtect
WinExec

Sections

.text
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 120B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 294B - Virtual size: 440B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ