59e0e0463b0e592c4bbc9e7f6686c567 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

59e0e0463b0e592c4bbc9e7f6686c567
Size

32KB
MD5

59e0e0463b0e592c4bbc9e7f6686c567
SHA1

6578a09fe068d1f1b2bf0e0817003e65a5610819
SHA256

9e9daf9feadad18071514cf137ee1056bf1a2f56a865fdf18f9101889b1f3e82
SHA512

c4c7230ea27356297919d75b6cb1a060097f9d3654bb26b57f3662d85744d4096ed7f290b5d6cb4c6ea067f1798a2cc46eca8223180b8ad738d490800b077e46
SSDEEP

384:v622279XZIZEcSHlyBkLTHTcyeTjs9vv/WQK:vhDjPMkLTHTZeTjYvvNK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
59e0e0463b0e592c4bbc9e7f6686c567

Files

59e0e0463b0e592c4bbc9e7f6686c567
.dll windows:4 windows x86 arch:x86

54582ad55ee8028141e79037ad49b9dd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

closesocket

msvcrt

free
_initterm
malloc
atoi
_itoa
memcmp
strncpy
strchr
strcmp
memcpy
??3@YAXPAX@Z
??2@YAPAXI@Z
strstr
fopen
fwrite
fclose
fread
time
memset
_strlwr
_adjust_fdiv

kernel32

Sleep
CopyFileA
GetModuleFileNameA
LoadLibraryA
GetProcAddress
GetTempPathA
CreateThread
lstrcmpA
lstrcpyA
lstrlenA
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
CreateEventA

Sections

.text
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 918B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ