57b454c6bb6f75c623f0f0b1f92687c5 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

57b454c6bb6f75c623f0f0b1f92687c5
Size

14KB
MD5

57b454c6bb6f75c623f0f0b1f92687c5
SHA1

b3e4038fc8c6e24c5413da0da63a683b60b8469e
SHA256

c12bcce121a58d8eabe66c56cb7c007e2450b3f63048be30f9f5f0004edd87cb
SHA512

e55560f2426d86f0b1ddf0f35bf59724f40ef14cb0bb1cfbcf500e09edcade88fd35dd8d48671c21f7efaf491ea7ba5fed4c244ae15c5ed1785d355758deb255
SSDEEP

192:/K2P3EgrBEAY2NIh9rXRPvbF6ZARBUjhQzUAbpED6kp/K0d9nFm2/xbYYr:/zP0uBX/Ih91vBuYyjhQgmMZl+C

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
57b454c6bb6f75c623f0f0b1f92687c5

Files

57b454c6bb6f75c623f0f0b1f92687c5
.dll windows:4 windows x86 arch:x86

a62e163b9670fbe94e8305211084eb7f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcAddress
LocalFree
FormatMessageA
GetLastError
LoadLibraryA
lstrcatA
GetSystemDirectoryA
CreateThread
GetModuleFileNameA
GetModuleHandleA
VirtualProtect
OutputDebugStringA

msvcrt

memcpy
strcmp
strlen
strrchr
strncpy
strchr
strcat
strcpy

user32

wsprintfA
wvsprintfA
UnhookWindowsHookEx

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

Exports

Exports

LpkDllInitialize
LpkDrawTextEx
LpkEditControl
LpkExtTextOut
LpkGetCharacterPlacement
LpkGetTextExtentExPoint
LpkInitialize
LpkPSMTextOut
LpkTabbedTextOut
LpkUseGDIWidthCache
ftsWordBreak

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 336B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ