aadffe19be59508f5190c40d28710b7c | Triage

Sharing

General

Target

aadffe19be59508f5190c40d28710b7c
Size

12KB
MD5

aadffe19be59508f5190c40d28710b7c
SHA1

11f0d8e41654f36fee5e4f02354f3bb143f1bffa
SHA256

22c9df4f8296c973127632fe0f772c3a504e3320ac570b681c278a3fe00799a0
SHA512

3c33c8735a035eeda1539ccde8986d0c06442b50aa2d6cb5b051ade7c9c0962c835535db7478fee3738c9a0c88767997ef1a88eaadbd17bccd3b4eff18d5878e
SSDEEP

192:hcVCAgNF+2ori0/fTfBQcgBr8mD7wYCFVOSOX82sn7ZjE:hAgNWtjBYBrJ7ELOSndn76

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aadffe19be59508f5190c40d28710b7c

Files

aadffe19be59508f5190c40d28710b7c
.dll windows:5 windows x86 arch:x86

2773743e993a6458be8e60a05c2ebd47

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetTickCount
GetFileSize
GetLastError
GetCurrentProcess
ReadFile

advapi32

LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken

urlmon

URLDownloadToFileA

wininet

DeleteUrlCacheEntry

Exports

Exports

Export

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 551B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ