5bdddecf852b2c5e6b6c0ec0377325b1 | Triage

Sharing

General

Target

5bdddecf852b2c5e6b6c0ec0377325b1
Size

15KB
MD5

5bdddecf852b2c5e6b6c0ec0377325b1
SHA1

1b794fabcd215c0769d787099e14195242c2c165
SHA256

5a529e93219dc191ddb5c3ec0751798a19d74375bd1f12e6c096e073ce51a585
SHA512

367fb8cce46f15c8eeb3c76b756fd26a3e2a9bbc1e77eb290ab397ef40671bbd1c5ee35dddba59273e9a58a2eea2924f00f9553856341367191c3308b5287019
SSDEEP

96:7tSsd6sFXA6GWJ28yQ0RXBfRMIMPWPbFJYVnjYFCk9WJ+U+d4n+Y+I+1g+6L+D+C:lWWJ2bvBfRCPWr76+wZprQdpf8lqRMS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5bdddecf852b2c5e6b6c0ec0377325b1

Files

5bdddecf852b2c5e6b6c0ec0377325b1
.dll windows:4 windows x86 arch:x86

a11d445a386037e2f25870aecd959e69

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

AddAtomA
CreateThread
DisableThreadLibraryCalls
FindAtomA
GetAtomNameA
GetModuleFileNameA
GetModuleHandleA
IsBadReadPtr
IsBadWritePtr
Sleep
VirtualProtect

msvcrt

__dllonexit
_errno
_iob
abort
fflush
fprintf
free
malloc
memcpy

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 176B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 220B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ