978f17342a78925f28b3a46fcd8da083 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

978f17342a78925f28b3a46fcd8da083
Size

28KB
MD5

978f17342a78925f28b3a46fcd8da083
SHA1

aed2d3d2aa5ffb29264110e6b8a15c5be16819f2
SHA256

7bc2265b72e5e53eadd802ce2377723c049e6d7c18d857df969b2542cb40f738
SHA512

6b18ddb49e89105b26db06ded4ebc0cbb2028333eb8ceba7e22fe5a16274dc4bf6f2f09db9fe482becf74067e901d1fcbadb6d8f8e609cc0d684a035f826a0d7
SSDEEP

384:2vAHEIL4HZoTtNx7SMxc6Pb38QZmV+tMsZ:2vUEIL45QxOMxPPb38d+tMW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
978f17342a78925f28b3a46fcd8da083

Files

978f17342a78925f28b3a46fcd8da083
.dll windows:4 windows x86 arch:x86

131ae5219a1ded71b3595b0e48c21f28

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

GetWindowTextA
EnableWindow
FindWindowA
FindWindowExA
EnumChildWindows

msvcrt

_initterm
_adjust_fdiv
_itoa
free
strchr
atoi
strcmp
memcpy
??3@YAXPAX@Z
??2@YAPAXI@Z
strstr
fopen
fwrite
fclose
fread
time
memset
_strlwr
malloc

kernel32

CreateThread
IsBadReadPtr
ExitProcess
lstrlenA
CopyFileA
lstrcpyA
GetModuleFileNameA
LoadLibraryA
GetProcAddress
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
Sleep
lstrcmpA
GetTempPathA

Sections

.text
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1020B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 720B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ