5471db5e5162925093a19f971354ecd9 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5471db5e5162925093a19f971354ecd9
Size

769KB
MD5

5471db5e5162925093a19f971354ecd9
SHA1

14ebbce941ba34d20f1fcc9f366ce64553aedfd6
SHA256

27c8de4887ee5b54b8c5f3a5bc35f19ad3461a9eada9d85abda7ed40c7bf7cf8
SHA512

eab85bee6b25bbc813f5758537cd1a1120b592953df65e77bb6bdd810a648a87616549652aede62c6830d15329c955df1ab0492f2532b443415c171d17a84891
SSDEEP

12288:yoxcaPvzluztY6nV6aJ5jGiqsGUD5gfYITf1E/vl:yADvp6ZnAQJD5gQIRE1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5471db5e5162925093a19f971354ecd9

Files

5471db5e5162925093a19f971354ecd9
.dll windows:4 windows x86 arch:x86

c2dd8b2417c47c04976d15f19f79dc5b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

Beep
HeapReAlloc
HeapDestroy
OpenEventW
FindResourceExW
FindResourceW
SetLastError
HeapAlloc
GetProcessHeap
HeapFree
OpenSemaphoreA

rpcrt4

RpcStringBindingParseW
RpcBindingVectorFree
RpcBindingToStringBindingW
RpcEpUnregister
RpcEpRegisterW
RpcServerListen
RpcServerRegisterIfEx
RpcServerRegisterAuthInfoW
RpcServerInqDefaultPrincNameW
RpcImpersonateClient
RpcRevertToSelfEx
UuidFromStringW
NdrAsyncServerCall
NdrServerCall2
RpcStringFreeW
RpcServerInqBindings
RpcServerUseProtseqW
RpcAsyncCompleteCall
UuidCreate
UuidToStringW
RpcMgmtStopServerListening
RpcAsyncAbortCall

Sections

.text
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 680KB - Virtual size: 679KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrh
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ