562fdd1213d3062cb3444c1b35ec91fd | Triage

Sharing

Copy URL Twitter E-mail

General

Target

562fdd1213d3062cb3444c1b35ec91fd
Size

32KB
MD5

562fdd1213d3062cb3444c1b35ec91fd
SHA1

81b4f7c2d0d20462c32cb4281bd1f809217ac703
SHA256

ae61e34af345b50a91d13094c76e8bb26c13a6e55c9b8fa1cd4eafc64b49ec1e
SHA512

d6ca9e68a34d0fa689ea6099344681944a62a910c18080f0d1b6f665064e484c2b0fad33f1e5bfd6fb1930fdb7f5c6c99d0d20611a1384fec17c6223730946d3
SSDEEP

384:Achw2xwSgeZcVL7EpEWTwTOUueTeiDlfSD7F:AcSupZSL7EuWTwTbueTeiDlfm7F

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
562fdd1213d3062cb3444c1b35ec91fd

Files

562fdd1213d3062cb3444c1b35ec91fd
.dll windows:4 windows x86 arch:x86

807160a2420350dad68ac44cd7139e42

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

ntohs
closesocket

msvcrt

atoi
free
_initterm
memcpy
_adjust_fdiv
_itoa
strcmp
strstr
strrchr
fseek
ftell
??2@YAPAXI@Z
strchr
strncpy
??3@YAXPAX@Z
fopen
fread
fclose
fwrite
time
memset
_strupr
_strlwr
malloc

kernel32

Sleep
GetModuleHandleA
CopyFileA
LoadLibraryA
GetProcAddress
GetTempPathA
CreateThread
SetEvent
WaitForSingleObject
lstrlenA
lstrcpyA
ReadProcessMemory
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
GetModuleFileNameA
lstrcatA
CreateEventA

Sections

.text
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ