4c23cbfc3285c8444905e59ae05b8243 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4c23cbfc3285c8444905e59ae05b8243
Size

21KB
MD5

4c23cbfc3285c8444905e59ae05b8243
SHA1

2c6a4e770d481d7952aaa7e8ae5f0af26c01060b
SHA256

d0d13b8e1149ac8de5b92eb3749f2a9b3586c8e2d4cfc324a6b7a78d7db56f3a
SHA512

c5fc5f96fb574b75d2a5e662849cf772aa178f6fe10c5ec0f3d885993586b4747e448b71e5dabf7c8f3f97a5abc74bd9d99d31dabc85eecc3cfafd258a903f24
SSDEEP

384:ER8KYiR22y9DYD5azRNOVG9pS77rWzhz+4Zjdtviyctf2xj1Y:E+2y9Do5az7Og4OzZZjdM2vY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4c23cbfc3285c8444905e59ae05b8243

Files

4c23cbfc3285c8444905e59ae05b8243
.dll windows:4 windows x86 arch:x86

caeb222b2a90135023e7042e8f42c132

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

WSACleanup
WSAStartup
recv
closesocket
send
gethostbyname
htons
socket
connect

kernel32

LoadLibraryA
OpenEventA
SetEvent
VirtualQuery
GetModuleFileNameA
lstrcatA
lstrlenA
GetTempPathA
GetWindowsDirectoryA
GetSystemDirectoryA
lstrcmpiA
lstrcpyA
lstrcpynA
Sleep
GlobalFree
GlobalAlloc
lstrcmpA
DeleteFileA
GetTempFileNameA
CloseHandle
WriteFile
CreateFileA
RtlUnwind
CreateProcessA
GetLastError
GetTickCount
FindClose
FindFirstFileA
FindNextFileA
MoveFileA
SetFileTime
ExitProcess
CreateThread

user32

SetWindowsHookExA
CallNextHookEx
SendMessageA
CharLowerA
wsprintfA

advapi32

RegCreateKeyA
RegQueryValueExA
RegCloseKey

Exports

Exports

Activate

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 3KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 554B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ