5b801dc7448c2763a43f64178d0aa5d6 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5b801dc7448c2763a43f64178d0aa5d6
Size

60KB
MD5

5b801dc7448c2763a43f64178d0aa5d6
SHA1

37c4cb6a425be27b6cf07b584f88c58f40693cf1
SHA256

876f6d784871d7eb72435ac17bdf90c9aa99e6401bbaddec5311f3a0ae4ccd22
SHA512

991be6e1018a00f623ed720cbb01d56e60470699ce3b6274845eb1e0a1bddc9a00717104f5c6496c8d94ce9aef11673df2645365c6b77f9bc791d977d5126e36
SSDEEP

768:Zv9H+7mnQ7yaipcb1ajLt2TFhYkA+IKYtuHSIDlTmiKdzFQrIJEM8gn:Zv9E02yai3jLt2TFakASE560Jz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5b801dc7448c2763a43f64178d0aa5d6

Files

5b801dc7448c2763a43f64178d0aa5d6
.dll windows:4 windows x86 arch:x86

daa62eb0dab0d7b398dbb5afd366ee50

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

OpenEventW
FindResourceExW
FindResourceW
SetLastError
HeapDestroy
GetProcessHeap
HeapFree
LoadLibraryW
LoadLibraryA
HeapReAlloc
HeapAlloc
Beep

rpcrt4

NdrServerCall2
RpcStringFreeW
RpcServerInqBindings
RpcServerUseProtseqW
RpcAsyncCompleteCall
UuidFromStringW
RpcRevertToSelfEx
NdrAsyncServerCall

crypt32

CryptUnprotectData
CryptProtectData

Sections

.text
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 410B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ