8074ea6bc191c574f369ff243b25c5cd | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8074ea6bc191c574f369ff243b25c5cd
Size

6KB
MD5

8074ea6bc191c574f369ff243b25c5cd
SHA1

4cafd3d625495e4ca72b386fe758cedb4f8daf34
SHA256

2f8476eaee5ac0b0ca9a38cf051e1025235b67f21dd91e7814050d771b30440c
SHA512

c67b345de0818cd99af5a6823bd52ad7419def1a68f99209c209339ecf9fd000349ccde693b27737788cd01cac0a6407cb72f3b97b3d18017abee9b892f4dc72
SSDEEP

96:d/xIrgxB4ck+uXoqpxsxT1GLGhGQnwi7VjK19xjCg8gLuHrV90kkTEIeN:d/ek8ck7XHpxsxT0eVm19x2KKp9VxN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8074ea6bc191c574f369ff243b25c5cd

Files

8074ea6bc191c574f369ff243b25c5cd
.dll windows:4 windows x86 arch:x86

8f2160992ca5322c5920bf6cb6b0a025

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetSystemDirectoryA
VirtualProtect
GetProcAddress
GetLastError
GetModuleFileNameA
FindNextFileW
CreateThread
Sleep
LoadLibraryA

user32

CallNextHookEx
SetWindowsHookExA

advapi32

RegOpenKeyA
RegSetValueExA

msvcrt

free
_strcmpi
_stricmp
strrchr
mbstowcs
wcsncpy
wcslen
_wcsicmp
_initterm
malloc
_adjust_fdiv

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 788B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 450B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ