9a9f950f9abae011bd7ff06b45ffe227 | Triage

Sharing

General

Target

9a9f950f9abae011bd7ff06b45ffe227
Size

8KB
MD5

9a9f950f9abae011bd7ff06b45ffe227
SHA1

02822ba60403bcefb8743ccd0f6e5180ab5f07eb
SHA256

f89f202c61e0fd863020f54dd623bf4387071688c5e540461f71f8d9ed015a3d
SHA512

4468dcb990b4ea8bd4393820ce3c969375b2ba5d6f2c939101eb31e1cf7e6437ad3070d11af8316b16563d28fb5791e083b0e300dce1856c748590a1eccbef4a
SSDEEP

96:roWUfqxqxcLAtWFDSVE2h2drwkqNUigi2S+BM72Wdi/Idtu:uxcyUuVE2h2a7fF2Q72ywku

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9a9f950f9abae011bd7ff06b45ffe227

Files

9a9f950f9abae011bd7ff06b45ffe227
.dll windows:4 windows x86 arch:x86

10a6ec7992ffe18ad57c12fc336d5f7c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetLastError
GetCurrentProcess
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
GetProcAddress
GetModuleHandleA
WriteProcessMemory
VirtualAllocEx
CreateToolhelp32Snapshot
Module32Next
Module32First
GetSystemDirectoryA
GetFileAttributesA
GetModuleFileNameA
GlobalAlloc
GlobalFree
LoadLibraryW
ExpandEnvironmentStringsW
Process32First
CloseHandle
OpenProcess
Process32Next

user32

wsprintfA

advapi32

LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges

ws2_32

WSCEnumProtocols
WSCGetProviderPath

msvcrt

_strcmpi
_stricmp
strlen
memset
strcat
_strlwr
strcpy
strrchr
_except_handler3
memcpy
free
_initterm
malloc
_adjust_fdiv

Exports

Exports

WSPStartup

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 540B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ