76a2e5088f16abbde13898d72125853c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

76a2e5088f16abbde13898d72125853c
Size

16KB
MD5

76a2e5088f16abbde13898d72125853c
SHA1

3e8f0aa612724399f11b6727450327292722cad7
SHA256

25deda708658478f6fd205ad17a458ca9a3ac72fad382dcd916aa152a6182053
SHA512

3c44fa7860a17da06f21c2652f4a8de71099009f1a44f124a9808b5e3c75d00335acd7250477a461214b8f0c6d4fb14e6aacb7bef3d52c1020edfe5234e8d97e
SSDEEP

192:f7Nmnae7pTFQP2jKc6V3bqu0V1GrQXtyKY1v:f7NYasp+2jUVVoyKy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
76a2e5088f16abbde13898d72125853c

Files

76a2e5088f16abbde13898d72125853c
.dll windows:4 windows x86 arch:x86

b1883da7e7b7eac0e6b2ef635b051d86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ReadProcessMemory
GlobalLock
GlobalAlloc
VirtualProtectEx
CreateThread
GetCurrentProcess
GetModuleHandleA
GetProcAddress
GetModuleFileNameA
CloseHandle
Sleep
GetCommandLineA
IsBadReadPtr
GlobalFree
WriteProcessMemory

user32

CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
GetKeyboardState
ToUnicode
GetAsyncKeyState
wsprintfA

advapi32

AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueA

wininet

InternetOpenUrlA
InternetOpenA
InternetCloseHandle

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sdata
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 542B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ