72bd6c4a8f3dc1a04a4bacc99a517992 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

72bd6c4a8f3dc1a04a4bacc99a517992
Size

36KB
MD5

72bd6c4a8f3dc1a04a4bacc99a517992
SHA1

5c2bf40aab7955f824b91819860ceb389a9169ab
SHA256

0657a928ee9b3c77b618f0fb53703f01022946ff452546ee78cd20a04ffc7dfc
SHA512

4b4af4db22832dbc0222a5b5c184be89bedfc21208aff0acbb1544e2dbfac26f4a5beac0b8e16fef4ab2b35fcf7810e0e2310f407e06d33cb36c84082566387f
SSDEEP

384:b30Pba3yp3Zc5xUDS5I38qCzar5WOHMQpct5t9999+/95y:b5kKxZ+RC4WOHMQat5Y/D

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
72bd6c4a8f3dc1a04a4bacc99a517992

Files

72bd6c4a8f3dc1a04a4bacc99a517992
.dll windows:4 windows x86 arch:x86

3e91566ad3f63f49469cae8d67653c4c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_adjust_fdiv
_stricmp
_strlwr
malloc
_itoa
_initterm
free
strncpy
strchr
atoi
memcpy
??3@YAXPAX@Z
??2@YAPAXI@Z
strstr
fopen
fwrite
fclose
fread
time
memset
sprintf

user32

EnumWindows
GetWindowTextA
GetWindowThreadProcessId

ws2_32

closesocket
ntohs

kernel32

Sleep
LoadLibraryA
CopyFileA
GetProcAddress
GetModuleFileNameA
GetTempPathA
lstrcpyA
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory
CreateThread
GetModuleHandleA
lstrcmpA
lstrlenA

Sections

.text
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 896B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ