518f693b072e6e0898069a5f3b8002a8 | Triage

Sharing

General

Target

518f693b072e6e0898069a5f3b8002a8
Size

16KB
MD5

518f693b072e6e0898069a5f3b8002a8
SHA1

60f1aff64039e7df98f27f99e4e5a74000ed0369
SHA256

ff6c0491e58612925d0b3f1836f11e14b1419769b2ef96f02701db9f40411041
SHA512

f32744f3cd95b845a2b0a1a32f8a28bcc2da9bd8d7bf82c0bbdcf99c7175f5981dedf2a3f0bc6622be8df1fda2dff4a5b8909a4628062f3a8f89216c570b373a
SSDEEP

384:vcczuv5k9LVogjpQ1OapqOkkPWfCv922Y0DpLWn0sMcSlppPpuL2HfbJ5OIMG5VV:NW6voioMNjxeB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
518f693b072e6e0898069a5f3b8002a8

Files

518f693b072e6e0898069a5f3b8002a8
.dll windows:4 windows x86 arch:x86

9eebbd1e1d2da18af116f6695a4d4a44

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateEventA
OpenEventA
TerminateProcess
GetCurrentProcess
GetModuleFileNameA
CloseHandle
SetEvent
GetFileSize
ReadFile
SetFilePointer
CreateFileA
HeapAlloc
GetProcessHeap
VirtualProtect
IsBadReadPtr
GetProcAddress
GetModuleHandleA
LoadLibraryW
MultiByteToWideChar
LoadLibraryA
GetPrivateProfileStringA
Sleep
CreateThread

user32

BroadcastSystemMessageA
SetWindowsHookExA
CallNextHookEx
wvsprintfA
wsprintfA

msvcrt

malloc
_strcmpi
_adjust_fdiv
strchr
atoi
strncpy
strcat
strcpy
strncmp
strlen
memset
strncat
free
memcpy
_except_handler3
strrchr
realloc
strstr
_strlwr
_initterm

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ