677a6ba82ea12d634230e404f3e3c5f8 | Triage

Sharing

General

Target

677a6ba82ea12d634230e404f3e3c5f8
Size

28KB
MD5

677a6ba82ea12d634230e404f3e3c5f8
SHA1

1318a5134b80909c476483fee7fc6402485d0c7c
SHA256

fc2ee4afb5841c63a281b31f517005ee48746253a5400140163f69d38d95eb35
SHA512

cd0c4203e2c4d5986a6137117f5dbbe2f73383888e9717b3f5532bae7ac28fb9eda0cec0f42143a44c9dcce8a7c5cbedaadf57f4de205522ef2e6b0eed79ed41
SSDEEP

192:LSkPXDXshIfo5Txgx6qcNWmLpw6DILWnCwm63PtPsibP7rEMeDNAGSAuH:HXjoBNxgx6RIeHn3m63PtPTbPnEMKN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
677a6ba82ea12d634230e404f3e3c5f8

Files

677a6ba82ea12d634230e404f3e3c5f8
.dll windows:4 windows x86 arch:x86

bbc50dbbc8b32cec1dc493079a1c0fb4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

free
_initterm
malloc
atoi
memcpy
strcmp
strstr
strrchr
fseek
ftell
??2@YAPAXI@Z
strchr
strncpy
??3@YAXPAX@Z
fopen
fwrite
fclose
fread
time
_adjust_fdiv
memset
_strlwr
_itoa

kernel32

Sleep
CreateThread
LoadLibraryA
CopyFileA
GetProcAddress
GetTempPathA
lstrcmpA
lstrcpyA
lstrlenA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
GetModuleFileNameA
lstrcatA
ExitProcess

Sections

.text
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ