467c1c0cbcf0383d2adc11ea367eea90 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

467c1c0cbcf0383d2adc11ea367eea90
Size

7KB
MD5

467c1c0cbcf0383d2adc11ea367eea90
SHA1

3fa6e3e557c6c3433ceea6aeab6a5b54e1274290
SHA256

791259d3aa0b43c4651cd8bbea6eae94d18b76295e53fc96ce97b6c19690f095
SHA512

4ea5ad40a0ac181d68e808559541a35be2a38229d459b7b0b91dfe1e27116d94014dcff79de67d43c4f274e9354b64d27169ae2d659c62b9f0a2830d036241be
SSDEEP

192:Lthc3gfdWqSCZPOlHnFpkGMLVPPVLT/iX:Lg30LPos7LVFf/iX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
467c1c0cbcf0383d2adc11ea367eea90

Files

467c1c0cbcf0383d2adc11ea367eea90
.dll windows:6 windows x86 arch:x86

daf239d34996e21744a633336bdf6c80

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

HeapAlloc
GetProcessHeap
HeapFree
CloseHandle
DeviceIoControl
CreateFileA
CreateProcessA
WriteFile
GetTempFileNameA
GetTempPathA
ResumeThread
SetThreadContext
WriteProcessMemory
VirtualAllocEx
ReadProcessMemory
GetThreadContext
lstrcatA
GetEnvironmentVariableA
QueryPerformanceCounter
WaitForSingleObject
Sleep
CreateThread

ws2_32

closesocket
recv
send
connect
htons
socket
WSACleanup
WSAStartup

Exports

Exports

WLEventStartShell

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 232B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ