4338301ba5f68403635aaa718bca16d1 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4338301ba5f68403635aaa718bca16d1
Size

8KB
MD5

4338301ba5f68403635aaa718bca16d1
SHA1

dfabd6a3ed4fd43ff7aaf44a34551b3114a8332a
SHA256

83aa61d2d4da69fcaaf4122a966a9738bb0bdcf206eb2035e389dc875776ff2e
SHA512

d6aa2d3f82a4c549ff32d46922adb1fbf452eb200a7b65a16f181a39209a2a42d756ac5bb8277f145aacb125a622485ddc68cc5b0790ce21ca392a437019df9d
SSDEEP

192:eQqN69MiuVsTmblxtYRPbpu8VxiTkeQAsOiqldGxzIb06pdmAh:XqN6SiuVKy7YRPYCc4A8Ob06pUs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4338301ba5f68403635aaa718bca16d1

Files

4338301ba5f68403635aaa718bca16d1
.dll windows:4 windows x86 arch:x86

54edd43b8cce2d147d868d979941e6b7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

ZwLoadDriver
RtlImageNtHeader
atol
RtlAdjustPrivilege
strchr
RtlInitUnicodeString
ZwFlushInstructionCache
ZwCreateEvent
mbstowcs
sprintf
_stricmp
_snprintf
memcpy
_chkstk

kernel32

CopyFileA
GetLastError
InterlockedExchange
GetProcAddress
LocalAlloc
CreateThread
GetTempPathA
WinExec
VirtualProtect
LoadLibraryExA
GetModuleHandleA
GetModuleFileNameA
LoadLibraryA
VirtualQuery
VirtualFree
VirtualAlloc
GetVersionExA
CreateFileA
GetLogicalDrives
WriteFile
Sleep
CreateDirectoryA
GetTempFileNameA
SetFileAttributesA
CloseHandle
MoveFileExA
FreeLibrary
GetTickCount
RaiseException

Sections

.text
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 160B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 378B - Virtual size: 544B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ