79be196d49e1b1f036df3647e282afc7 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

79be196d49e1b1f036df3647e282afc7
Size

10KB
MD5

79be196d49e1b1f036df3647e282afc7
SHA1

63c9618780ce7ce4dd67f4a67064cbf8a9267ea5
SHA256

f5a7d01f2dd9f7dc5c8c2ffee3b81d0e7f1f723de748d719c98c85d6c69f8b48
SHA512

cd603f0a6f866b3662d682097af283ba688601867dc46694c341b3829c41f2b0027495e1e3be71468021be70e99fec964d7c5bf06f6245c8ee5a05c8aedea176
SSDEEP

192:zpkorV46+l/wB7zFnWUYtZeOhHGBvKyDV0RmPD+SWKv0:lFrBliKvKKVQSWKv0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
79be196d49e1b1f036df3647e282afc7

Files

79be196d49e1b1f036df3647e282afc7
.dll windows:4 windows x86 arch:x86

c5451ffd08effea41f2ee885f536b124

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
CompareStringA
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
GetProcAddress
GetModuleHandleA
OpenProcess
CreateThread
GetModuleFileNameA
IsBadReadPtr
GetCurrentProcess
FreeLibrary
GetCurrentThreadId
InterlockedExchange
RtlUnwind
VirtualProtect
GetProcessHeap
lstrlenA
HeapAlloc
VirtualQuery

user32

TranslateMessage
GetMessageA
KillTimer
SetTimer
FindWindowA
GetWindowThreadProcessId
DispatchMessageA
wsprintfA

advapi32

AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueA

wininet

InternetOpenUrlA
InternetReadFile
InternetCloseHandle
InternetOpenA

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 650B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ