63b0857db3aa090eb8a46a469c68bc4c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

63b0857db3aa090eb8a46a469c68bc4c
Size

36KB
MD5

63b0857db3aa090eb8a46a469c68bc4c
SHA1

7b96325fd23282c78f1df6e090a0f565f53e9984
SHA256

2b599e1fea7301a3bf181b4949b7e48abb09067e06501b072a5dcb574d97c79c
SHA512

a1fa2c4f7edbf8709dbeb99a79faa40a3d67379b42520f0c382312143b1b04992f8f7a9608f95eeccce303b675868e6bdf11cfda52bfaafb1a795b6d4f54574c
SSDEEP

384:8J30Pba3Zp35E15UDShIr8etg5orOq+sQpct5t9999+X95y:8J5pe5ZWJtgHq+sQat5YXD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
63b0857db3aa090eb8a46a469c68bc4c

Files

63b0857db3aa090eb8a46a469c68bc4c
.dll windows:4 windows x86 arch:x86

3e91566ad3f63f49469cae8d67653c4c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_adjust_fdiv
_stricmp
_strlwr
malloc
_itoa
_initterm
free
strncpy
strchr
atoi
memcpy
??3@YAXPAX@Z
??2@YAPAXI@Z
strstr
fopen
fwrite
fclose
fread
time
memset
sprintf

user32

EnumWindows
GetWindowTextA
GetWindowThreadProcessId

ws2_32

closesocket
ntohs

kernel32

Sleep
LoadLibraryA
CopyFileA
GetProcAddress
GetModuleFileNameA
GetTempPathA
lstrcpyA
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory
CreateThread
GetModuleHandleA
lstrcmpA
lstrlenA

Sections

.text
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 892B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ