8b36fb5521eba9ad3aaf7db9d393ff2f | Triage

Sharing

General

Target

8b36fb5521eba9ad3aaf7db9d393ff2f
Size

24KB
MD5

8b36fb5521eba9ad3aaf7db9d393ff2f
SHA1

adb69c9fc0f47c763c36c8511ccbd2fef25f3ad4
SHA256

3468771b191dee52f8e408ff1d0bce942310b8502973af572af735435a9e6750
SHA512

9f12b156fde88181e1094320bd7c1477f9c506dfc13148c542e05650b2d0a26fa291ad8028c9b665f4b0a45e40f8d3e45a6429e51e75f77340cbef3b70fca83a
SSDEEP

384:6kmDjH6Y4kdH0+IJDUtHwpdpxJqpct5sZ5So:ofu/fUtHwpdpxAat5sZ5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8b36fb5521eba9ad3aaf7db9d393ff2f

Files

8b36fb5521eba9ad3aaf7db9d393ff2f
.dll windows:4 windows x86 arch:x86

68b33a75cf5c13ae2b4647387053c8f8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

EnumWindows
GetWindowTextA
GetWindowThreadProcessId
SetWindowTextA
GetClassNameA
EnumChildWindows

ws2_32

ntohs

msvcrt

strchr
free
_initterm
malloc
_adjust_fdiv
_itoa
strcmp
atoi
memcpy
memset
strstr
fopen
fwrite
fread
fclose
??2@YAPAXI@Z
sprintf
??3@YAXPAX@Z
_strlwr
time

kernel32

lstrlenA
CopyFileA
ExitProcess
VirtualAlloc
GetModuleHandleA
lstrcmpA
Sleep
lstrcpyA
GetProcAddress
GetModuleFileNameA
CreateThread
GetTempPathA
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory
LoadLibraryA

Sections

.text
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 866B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ