67f371faa6028f6350d534881d86c730 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

67f371faa6028f6350d534881d86c730
Size

28KB
MD5

67f371faa6028f6350d534881d86c730
SHA1

2f9e7459c8ae8b01f245538849f63db3fbbfad2c
SHA256

3c967937a17b6c82c0497493bb3ef7bcd937254af3992a39984e70d4de421813
SHA512

f6f5ef084fded1f3edb99b3c4728cf7164e11a0f6a7345e380c26f2e1c5914f9cd1ceec11f7740ba2b2a8bd662aa930e495e03e86d35aacd9a9444724cf60d09
SSDEEP

384:MmSyf0c/wNiHA51lqbPfPuL8P61Pi29eTpAHCWPbZ6:Mmlsc/wUgr8bPfP08P0Pi29g+HCsZ6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
67f371faa6028f6350d534881d86c730

Files

67f371faa6028f6350d534881d86c730
.dll windows:4 windows x86 arch:x86

aee43af8163c39c6a5357f02b45d97a5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

closesocket
ntohs

msvcrt

_adjust_fdiv
malloc
_itoa
_initterm
free
atoi
strcmp
memcpy
strstr
strrchr
fseek
ftell
strchr
strncpy
??2@YAPAXI@Z
sprintf
??3@YAXPAX@Z
fopen
fwrite
fclose
fread
time
memset
_strupr
_strlwr

kernel32

CreateEventA
Sleep
WaitForSingleObject
GetModuleHandleA
GlobalAlloc
GlobalLock
CreateThread
lstrlenA
LoadLibraryA
CopyFileA
GetProcAddress
GetTempPathA
SetEvent
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
GetModuleFileNameA
lstrcpyA
MultiByteToWideChar
WideCharToMultiByte
ExitProcess

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ