514e2ae1783277d36642d56cbec4066a | Triage

Sharing

Copy URL Twitter E-mail

General

Target

514e2ae1783277d36642d56cbec4066a
Size

16KB
MD5

514e2ae1783277d36642d56cbec4066a
SHA1

7d76f2a442ed60e050cf8e0e8464dec68b7dc467
SHA256

e0a8217b0b43dc1da5827869084e3bf542dd27922f27d328e951362b8bb76a1c
SHA512

4c34bdcb338320c3a705e9cb8359047c3cf4c25f0dadc1f5e43af30143f2fea728393c3e28a6f6966b21319e653da47513ed649ba585296520d8d45ebdaa91fe
SSDEEP

384:AGmUaWnqYBuVTYgL/e2buBBQARQkXNX1mUX:AGxRBLBBQARQkdlm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
514e2ae1783277d36642d56cbec4066a

Files

514e2ae1783277d36642d56cbec4066a
.dll windows:4 windows x86 arch:x86

6c47221602350c9cce0e438fb55e9c73

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

gethostname
closesocket

ntdll

memcmp
memcpy
strlen
strstr
RtlZeroMemory

kernel32

GlobalFree
CreateThread
lstrlenA
lstrcatA
VirtualProtectEx
lstrcmpA
OutputDebugStringA
lstrcpynA
lstrcpyA
lstrcmpiA
WaitForSingleObject
TerminateThread
Sleep
CloseHandle
CreateFileA
GetExitCodeThread
GetFileSize
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GlobalAlloc
ReadFile
LoadLibraryA
IsBadReadPtr

user32

CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
wsprintfA

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 626B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ