554eb80a2562f3c1fa0bc474579cb782 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

554eb80a2562f3c1fa0bc474579cb782
Size

45KB
MD5

554eb80a2562f3c1fa0bc474579cb782
SHA1

97839c4548f8673e7981207975966bf1eba259c9
SHA256

3bcd49740e8b78e5b841bcb5ab4c205d8a7898141706df241b49cad89ca77b4a
SHA512

71c1f6c8fd6c2b67dde0990f9dae9fe86592559b841bf491608b10bd4a12f77e622cb0180660c66be9007691919230341506eda3e5b99f3f69e086602b9ca035
SSDEEP

768:MXuicQgsUjxFHSWS18YsIFVkLNZbhdiex9ilxoEvwqJwbZlP6ocT2AWFppPU5T2H:hQIVFBSXs6cNZ9MeHilxoaOZlP6A3fy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
554eb80a2562f3c1fa0bc474579cb782

Files

554eb80a2562f3c1fa0bc474579cb782
.dll windows:4 windows x86 arch:x86

2939019b3e1c9516282f24ae4f08a1e6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WinExec
ExitProcess
TerminateThread

msvcrt

_eof
_chkesp
_ctype
_except_handler2
_CItanh

advapi32

CloseEventLog
CryptGetHashParam
AdjustTokenGroups
CryptSetHashParam
DeleteAce
DuplicateToken

Sections

.text
Size: 28KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE