7ab3eea78f2bc1e229c1f21a66b2f354 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

7ab3eea78f2bc1e229c1f21a66b2f354
Size

28KB
MD5

7ab3eea78f2bc1e229c1f21a66b2f354
SHA1

40913c6364853593db7b1560e64c598e0811cef4
SHA256

26f97fff6eb1ab2391aea732c80abea2c67c1be5dca91928ec755698c485bbc9
SHA512

bdc63092cd8a892d407e45a7bab0c3c53d4d1d15884a660fc2f5d0849686a8200254f930fc8cf229daa6b025a375f738b7ef47bf54fd3161de2b33d723859d2d
SSDEEP

384:26hMgZNJMUjHRYBcuxsrUjr38QwmV+tMy:20MKvMyxYBh0kr38Y+tM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7ab3eea78f2bc1e229c1f21a66b2f354

Files

7ab3eea78f2bc1e229c1f21a66b2f354
.dll windows:4 windows x86 arch:x86

131ae5219a1ded71b3595b0e48c21f28

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

GetWindowTextA
EnableWindow
FindWindowA
FindWindowExA
EnumChildWindows

msvcrt

_initterm
_adjust_fdiv
_itoa
free
strchr
atoi
strcmp
memcpy
??3@YAXPAX@Z
??2@YAPAXI@Z
strstr
fopen
fwrite
fclose
fread
time
memset
_strlwr
malloc

kernel32

CreateThread
IsBadReadPtr
ExitProcess
lstrlenA
CopyFileA
lstrcpyA
GetModuleFileNameA
LoadLibraryA
GetProcAddress
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
Sleep
lstrcmpA
GetTempPathA

Sections

.text
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1020B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 720B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ