7277e28b560af4100270d3b83c535a88 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

7277e28b560af4100270d3b83c535a88
Size

28KB
MD5

7277e28b560af4100270d3b83c535a88
SHA1

5d4b46f49f1ac6df18a4dbee1c8158e12fd0b070
SHA256

ab94b7b44f2f6a3641600ef4d11d45c152db2757951ecf5591de27d84e9b985a
SHA512

cef466b983dbae445f613b4f639e9ef9b18288eeb984cef8f41b9f8cb9ca70784ca7f232fbf53125734b0a6bb140378e7db73ff4085202b2bbe93b63c5009a99
SSDEEP

384:hXPn9yL73Bd/Lc+z3biv/K6NTgZMMQvg:tML7Rd/LcCb+K6NTgeT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7277e28b560af4100270d3b83c535a88

Files

7277e28b560af4100270d3b83c535a88
.dll windows:4 windows x86 arch:x86

8d3b1e7e15b78178be54d722f8efaaba

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

FindWindowA
GetWindowTextA

msvcrt

_adjust_fdiv
malloc
_initterm
free
strlen
atoi
memcpy
strstr
??3@YAXPAX@Z
??2@YAPAXI@Z
memset
_strlwr

kernel32

VirtualProtectEx
TerminateProcess
CreateThread
OutputDebugStringA
GetModuleHandleA
Sleep
GetTempPathA
CopyFileA
GetModuleFileNameA
LoadLibraryA
GetProcAddress
lstrlenA
lstrcatA
GetCurrentProcess
GetCurrentProcessId
ReadProcessMemory
lstrcpyA

Sections

.text
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 846B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 752B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ