4a30544e633e4bf0b5c6e5c1f28d3dcf | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4a30544e633e4bf0b5c6e5c1f28d3dcf
Size

28KB
MD5

4a30544e633e4bf0b5c6e5c1f28d3dcf
SHA1

90903405a318776677cf63d36af9cb9bdbfbbd17
SHA256

33425d735db35fa09319bc084913bcea1f8a45531ff02cc633c9e355434a06c4
SHA512

a0e0adfce05de0c3e56c5e9caa4f0a7909583080a5db62f2d15c742151d5956b47f66f19864f2e8b3194d56648048a7ec00c2290bb235b5df455755adb549c1b
SSDEEP

384:intsYPppAtdUpLJIg9Wj9JThxbJAmGpct5NtabwQ:cnxphpLJIQWj9JbJ/Gat5NbQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4a30544e633e4bf0b5c6e5c1f28d3dcf

Files

4a30544e633e4bf0b5c6e5c1f28d3dcf
.dll windows:4 windows x86 arch:x86

df7e7367b810b262a31dd4452638304d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_adjust_fdiv
memset
malloc
_initterm
free
memcmp
atoi
memcpy
strstr
strrchr
fseek
ftell
strchr
strncpy
??2@YAPAXI@Z
??3@YAXPAX@Z
fopen
fwrite
fclose
fread
time
_strlwr
_itoa

kernel32

ExitProcess
Sleep
LoadLibraryA
CopyFileA
GetProcAddress
CreateThread
GetTempPathA
lstrcmpA
ResumeThread
lstrlenA
lstrcpyA
CreateRemoteThread
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory
GetModuleFileNameA
lstrcatA

Sections

.text
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 956B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 794B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ