5a20edcd0fe9797349d0895fc85498c1 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5a20edcd0fe9797349d0895fc85498c1
Size

44KB
MD5

5a20edcd0fe9797349d0895fc85498c1
SHA1

8c2fb44a2b4717bab1d54b50a362783fe6238069
SHA256

0642a82fc2f20223546632ee504bfd4c1b820f1704d43224362a2d9b5cbcbb16
SHA512

b789cd17966f5a0ff4332887e48fe8f727f6c1d373dd2c4f79b34cf60bddc2a2890b94ea2ee7ea6a0bfbf1e6385df988a22d9bb23e3bf50d6395a795aa04bdb9
SSDEEP

384:Zwgmy+8StjbALTf5fnC4Opt4Fy7J0+2T2UG37aXU8jfF3Ty3cGehZZukMAx:ZCypOkLTf5fnC4OLF0+2T83M1TtGePZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5a20edcd0fe9797349d0895fc85498c1

Files

5a20edcd0fe9797349d0895fc85498c1
.dll windows:4 windows x86 arch:x86

0ac0b2be0fac6ee37dc037b16cc2110b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ord795
ord845
ord844
ord843
ord565
ord560
ord329
ord476
ord248
ord765
ord346
ord349
ord775
ord770
ord772
ord724
ord774
ord385
ord722
ord443
ord377
ord441
ord214
ord395
ord304
ord305
ord811
ord362
ord364
ord397
ord365
ord477
ord512
ord511
ord841
ord513
ord822
ord522
ord225
ord552
ord509
ord318
ord312
ord406
ord793
ord515
ord419
ord553
ord657
ord594
ord550
ord551
ord444
ord447
ord525
ord528

Exports

Exports

GetHeroAudio

Sections

.text
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ