48c4bd84ff0594d726f323ebc28ed0bd | Triage

Sharing

General

Target

48c4bd84ff0594d726f323ebc28ed0bd
Size

9KB
MD5

48c4bd84ff0594d726f323ebc28ed0bd
SHA1

15fa6dd49f4ad1d299ec35c544237987ada3feee
SHA256

eea158f547431851938582ea50c84c468ff7fbddb9731f1ef4c0f8bb37f9963c
SHA512

919b7890ea1071395478c2ff28bf1046d6e3d2f437dc663c200ab16a2264955c8c3fc27397f3fcd02382bf3ae5d8fc7089538230d927fd921edb11421178d494
SSDEEP

96:BPOvGDFeem3DQjeXQBMt1tkPw4l4TNxbdjJzhA77aV1YOXH5O9Td4:8LeSOoMoTTRjbAmFY9p

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
48c4bd84ff0594d726f323ebc28ed0bd

Files

48c4bd84ff0594d726f323ebc28ed0bd
.dll windows:4 windows x86 arch:x86

bc2d142be9deb087c3a6e356536be7bf

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ReadProcessMemory
GlobalFree
GlobalLock
GlobalAlloc
GetCurrentProcess
VirtualProtectEx
CloseHandle
CreateThread
WriteProcessMemory
GetModuleFileNameA

user32

UnhookWindowsHookEx
FindWindowA
GetWindowTextA
wsprintfA
SetWindowsHookExA
CallNextHookEx

advapi32

LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges

wininet

InternetOpenA
InternetOpenUrlA
InternetCloseHandle

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sdata
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 450B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ