4d3905f6fe1eb9666348a83970b92421 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4d3905f6fe1eb9666348a83970b92421
Size

24KB
MD5

4d3905f6fe1eb9666348a83970b92421
SHA1

5d5b6806fc2fa0afb14421ab011c10d1cf3cf140
SHA256

c150a32b4050f2b96cceed7dc6508ea730bea583b29d47816e670900789430dd
SHA512

c1540f78a51cadf31b565db31dcc0cd44e6f22464cce4ef3c03de5966ebcee7b8c83082819391a48b051003f1b62eb46d4651338057c530e6a0a000b7c76f43b
SSDEEP

384:Cwv04S9pZtd3UXGC+8lfBIs4ueqzioe88IccCjla:CwTS9pZtd3UXllfBIs4ueqzioeTI9CU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4d3905f6fe1eb9666348a83970b92421

Files

4d3905f6fe1eb9666348a83970b92421
.dll windows:4 windows x86 arch:x86

98e1470a2108ffbb2907530e8938dcaa

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

ntohs
closesocket

msvcrt

malloc
_initterm
_itoa
free
strchr
memcmp
atoi
memcpy
??3@YAXPAX@Z
??2@YAPAXI@Z
strstr
fopen
fwrite
fclose
fread
time
memset
_strlwr
_adjust_fdiv

kernel32

Sleep
GetModuleHandleA
lstrlenA
LoadLibraryA
CopyFileA
GetProcAddress
GetModuleFileNameA
GetTempPathA
lstrcpyA
DeleteFileA
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory
CreateThread

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 926B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 714B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ