490a60ff0235be98e2f526e567371cf5 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

490a60ff0235be98e2f526e567371cf5
Size

6KB
MD5

490a60ff0235be98e2f526e567371cf5
SHA1

690df5ff7c51a1a6650517386e6cd513a1356cf0
SHA256

3b45d28576c8dfa9ae5df8d772fffafadebde3477aafc392e50a6756657dbbd0
SHA512

4b6d2edeea5386e631dd9657bbd7940be84f3305b35b0a87bb63558154761ad9260d16f6cb69d817db17daf73ec25e4f27e53cd5475cc87459601d1459b84259
SSDEEP

96:ulXZu/o77+r/tNNgQAHEaa995ioZcjHxUBN:uDu/ono/Z1l9IoZs2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
490a60ff0235be98e2f526e567371cf5

Files

490a60ff0235be98e2f526e567371cf5
.dll windows:4 windows x86 arch:x86

a3ae497436ef893c553ee1969fb06ac8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateThread
GetCommandLineA
CreateMutexA
GetModuleFileNameA
GetPrivateProfileStringA
lstrlenA
WinExec
lstrcmpA
Sleep
DeleteFileA
GlobalAlloc
lstrcatA
lstrcpyA
GetSystemDirectoryA
GetModuleHandleA

user32

CallNextHookEx
SetWindowsHookExA
CharUpperA
CharLowerA
wsprintfA

urlmon

URLDownloadToFileA

wininet

DeleteUrlCacheEntry

Exports

Exports

ENProcess
HDDGuard

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 812B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 210B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ