66569d10c6b66f4f796fd2e7c1ab62cf | Triage

Sharing

Copy URL Twitter E-mail

General

Target

66569d10c6b66f4f796fd2e7c1ab62cf
Size

3KB
MD5

66569d10c6b66f4f796fd2e7c1ab62cf
SHA1

2330994b928624efe078cd43ffd73ee753a08bbf
SHA256

5cd337677db2ae419b0a610475562cc12c1437a879016df2af0f701a7a31a6d0
SHA512

548792c9f9a62dc9b1a81e372281abd474fd15060be1de760ce0f06343986e15f20a291e9c703e2e13d19a50902e38f7da545dc073f046e37f69d4e4cdf4b94a

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
66569d10c6b66f4f796fd2e7c1ab62cf

Files

66569d10c6b66f4f796fd2e7c1ab62cf
.dll windows:4 windows x86 arch:x86

5d67ca2286452ee6c1a6d95cd09ea0b2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcessHeap
Sleep
GetLastError
lstrcmpiW
CreateMutexA
CloseHandle
CreateThread
HeapFree
lstrcpynW
GetProcAddress
VirtualAlloc
GetModuleHandleA
VirtualProtect
WriteProcessMemory
GetCurrentProcess
HeapAlloc
ReadProcessMemory

user32

SetWindowsHookExA
CallNextHookEx

advapi32

LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ