221e8eb425440d4930863d9db326b99374959028253d68739e545123105e1a92 | Triage

Sharing

General

Target

221e8eb425440d4930863d9db326b99374959028253d68739e545123105e1a92
Size

1.4MB
MD5

e18eb3f977a53cd1aecbb06d5e007fc3
SHA1

0212eb04e9578dab964e50df6b056cd6e9c2a110
SHA256

221e8eb425440d4930863d9db326b99374959028253d68739e545123105e1a92
SHA512

41e6bbc7c62a9059453f5379968c70a8fed5b6ac60bc2693f1574c8a756cc5a43d24299f8fd4a74277b75589842309b3820350bfde693a1687e1b6dd7d3a6ebe
SSDEEP

24576:2lSLiRPiZ6CC/AhTWHP1hvR+jyHvx3/nGNAKBe9M07YhSFtC7IQdxKHTtyRXeluT:uSLiRP3CC4BYvRNvx3Q6d0ho47xaiXie

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
221e8eb425440d4930863d9db326b99374959028253d68739e545123105e1a92

Files

221e8eb425440d4930863d9db326b99374959028253d68739e545123105e1a92
.dll windows:4 windows x86 arch:x86

50550cc71a15cd10a4a56e24dc581389

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

memmove
atoi
??3@YAXPAX@Z
__CxxFrameHandler
strncmp
malloc
free
strchr
_ftol

kernel32

GetModuleHandleA
LCMapStringA
LoadLibraryA
GetProcAddress
FreeLibrary
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetProcessHeap

user32

wsprintfA
MessageBoxA

Exports

Exports

AddNoChange_File

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 754B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Cu{
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 680B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 680B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ