5ae7d3b02e0b640d549425459a747a1a | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5ae7d3b02e0b640d549425459a747a1a
Size

7KB
MD5

5ae7d3b02e0b640d549425459a747a1a
SHA1

951be9bcc91b0a9d2d8904df462f2afee4b7e3b8
SHA256

c5ab3e080e25830db135e2842aba5e287d69e5313fc7171521eebd4fb4eeaf6e
SHA512

ea83de8499fd18c0a164e9e11e1d9a935799c6ecd6a57de42ea14919be0ad452ca3cf684ad1637f309b686bacab65ea2f21e12c2e28ac6e195051658e93ec0d3
SSDEEP

96:6JzspttM1TL22hyErap3xAGvOY8l8BEwXP9/7ouISE90lkyGlFF:b3ITEPp3x7vOngEwXP9/7RI/9VF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5ae7d3b02e0b640d549425459a747a1a

Files

5ae7d3b02e0b640d549425459a747a1a
.dll windows:4 windows x86 arch:x86

20d405c2b7dce035cffed4ec5af91ec8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleFileNameA
GetSystemDirectoryA
LoadLibraryA
GetLastError
Sleep
HeapFree
CreateThread
GetProcessHeap
HeapAlloc

user32

CallNextHookEx
SetWindowsHookExA

advapi32

InitializeSecurityDescriptor
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
RegOpenKeyExA
RegSetKeySecurity
RegCloseKey
FreeSid
RegSetValueExA
RegOpenKeyA
AllocateAndInitializeSid

msvcrt

_initterm
_stricmp
strrchr
free
_strcmpi
malloc
_adjust_fdiv

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 980B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 418B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ