aa8e56ef4ba6a51ebdf4bdeb110d97cf | Triage

Sharing

General

Target

aa8e56ef4ba6a51ebdf4bdeb110d97cf
Size

2.3MB
MD5

aa8e56ef4ba6a51ebdf4bdeb110d97cf
SHA1

2c062964b151ce9622d42f35ca85d025b223d3f4
SHA256

b6236df1f5dabd5209fc059b8fcd5b48064f472076f5ee698f9bb3f5cc09c079
SHA512

65f5540daf28e0574e4f386c11e111eab600156173589400a8c857cd7ee0751ff8ea007746ebb4f6ea84a07e28aaff258028f7d2a1e9c826cd4bd39589154375
SSDEEP

49152:2iB+cfRWkkjY5qUHj1FhW825PlJ0TJcttcCmIf+i:0sWkkjaHjTo82Pb0c00

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aa8e56ef4ba6a51ebdf4bdeb110d97cf

Files

aa8e56ef4ba6a51ebdf4bdeb110d97cf
.dll windows:4 windows x86 arch:x86

7368b5b37128a9667cdfbc04ae1dfb07

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentProcess
Sleep
GetModuleFileNameA
CloseHandle
SetEvent
IsBadReadPtr
GetFileSize
ReadFile
SetFilePointer
CreateFileA
HeapAlloc
GetProcessHeap
VirtualProtect
TerminateProcess
GetProcAddress
GetModuleHandleA
LoadLibraryW
MultiByteToWideChar
LoadLibraryA
OpenEventA
CreateEventA
CreateThread

user32

SetWindowsHookExA
CallNextHookEx
wvsprintfA
wsprintfA
BroadcastSystemMessageA

msvcrt

malloc
_strcmpi
_adjust_fdiv
strcpy
strcat
strlen
strncpy
strchr
memset
strstr
isdigit
strncmp
free
memcpy
_except_handler3
strrchr
realloc
_strlwr
_initterm

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ