542f850e5ebdbfd78237cc3db3dad04c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

542f850e5ebdbfd78237cc3db3dad04c
Size

43KB
MD5

542f850e5ebdbfd78237cc3db3dad04c
SHA1

6c8a7e7f0bfd9312d23491595f2c506f16c40adf
SHA256

79b78f2e635f8d92d51c5a86cffbb1e7144607752f10e26827e7053cd99c0c04
SHA512

bfd732ee127ece74a11118e47b6591bb65bc7bfb1c9925f24c50c6b1f3f03409c24d9177852ee4a8b3976dcaf9ed5eee85d89f26bfcfd7c58225744a25454833
SSDEEP

768:Kru6qikoYFsuxODSShfabMrjVxcAirCLBBZwnU/PluP7Oq9JFh1kZfAIRBMffAV:KrNqToYFiSifBD02BwU/Qx4oBoV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
542f850e5ebdbfd78237cc3db3dad04c

Files

542f850e5ebdbfd78237cc3db3dad04c
.dll windows:4 windows x86 arch:x86

721bb131dae2d40a9fe518cd21f0becc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

avicap32

capCreateCaptureWindowA

shell32

ShellExecuteA

user32

ExitWindowsEx

shlwapi

StrCmpW

gdi32

CreateCompatibleBitmap

advapi32

RegQueryValueExA

ole32

CreateStreamOnHGlobal

ws2_32

listen

psapi

GetModuleFileNameExA

imm32

ImmReleaseContext

winmm

waveInUnprepareHeader

msvcrt

strrchr

Exports

Exports

rtftgfgtgf
DoService
ServiceMain

Sections

.rdft
Size: 24KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

dsewq
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gyumn
Size: 3KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE