5ac954e704685ce82008707336f5a937 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5ac954e704685ce82008707336f5a937
Size

7KB
MD5

5ac954e704685ce82008707336f5a937
SHA1

502aa73b769b1c78f1800b33ead21c967644d5be
SHA256

61892df82461e3e8d571a3890724d31250acd6e1b8972d1d6dcfa89e4b5c8d55
SHA512

3bf10bd2549969b0c28c89a5a893191fcc954addd1f469737eb32342f44231acb0844f10340ba70ce74e61d57ec0577bd31a37eae969a456de9b857ffa03068f
SSDEEP

192:eQOX4Nw+T67prryEI3DhRA2JjOSF4JmI706pyOw4:XKqXTx1hRPJ6JB706pvJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5ac954e704685ce82008707336f5a937

Files

5ac954e704685ce82008707336f5a937
.dll windows:4 windows x86 arch:x86

17b1c8d50b732bf269363bd2277d1f4a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

RtlImageNtHeader
atol
strchr
ZwCreateEvent
_stricmp
_snprintf
sprintf
memcpy

kernel32

SetFileAttributesA
LoadLibraryA
GetLastError
InterlockedExchange
GetProcAddress
LocalAlloc
CreateThread
GetTempPathA
VirtualQuery
VirtualFree
GetVolumeInformationA
Sleep
VirtualAlloc
GetVersionExA
CreateFileA
GetLogicalDrives
WriteFile
CreateDirectoryA
CopyFileA
RaiseException
CloseHandle
MoveFileExA
FreeLibrary
GetTickCount
GetTempFileNameA
GetModuleFileNameA
GetModuleHandleA
LoadLibraryExA
VirtualProtect
WinExec

Sections

.text
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 120B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 302B - Virtual size: 450B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ