8b7e0f756bea5128e7e714ed8ac81d0b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8b7e0f756bea5128e7e714ed8ac81d0b
Size

184KB
MD5

8b7e0f756bea5128e7e714ed8ac81d0b
SHA1

a70ee44cc959fece6c3393fb6b460f6828d8a6ce
SHA256

a1534ce33a2ff3ab50f0fa207467550b0f8126befdc4fc82034e4f46d807dde2
SHA512

a3636af6357092bc6da0059b2d84eaa32f12c885a40010056f5c0aa2720358cc21507290f192374e9c5b9eb8ea7ed232a4ce0f0cc20b90b7db1ed2275c5e089e
SSDEEP

3072:iqJs2vTNBtg6SSiP2uPGub071f8eWdwBIZ2qSeOVg2f0LhSLl84aci2+e2f2:iqbNfaScP47aeWdWqgj0LI8zb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8b7e0f756bea5128e7e714ed8ac81d0b

Files

8b7e0f756bea5128e7e714ed8ac81d0b
.dll windows:5 windows x86 arch:x86

07a08e3e316eca8e37df205ff5246906

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

gdi32

CreateColorSpaceA

msvcrt

memset
strlen

oleaut32

VarR8FromCy
VarDecFromR8

kernel32

FindActCtxSectionGuid
Sleep
GetGeoInfoW
GetModuleFileNameA
LoadLibraryExA
GetModuleHandleW

advapi32

RegLoadAppKeyA
RegisterServiceCtrlHandlerA

user32

UnionRect
ShowOwnedPopups

crypt32

CryptFreeOIDFunctionAddress

mprapi

MprAdminMIBEntryGetNext

setupapi

SetupCloseInfFile

ntdsapi

DsBindWithCredW

winmm

waveOutGetPitch

Exports

Exports

WeprmcFosller

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 124KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ