69e7b08c127dde5fd1f85e1e8107d06aa686e94aef3fd48ff0bb092b38a0cb1d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

69e7b08c127dde5fd1f85e1e8107d06aa686e94aef3fd48ff0bb092b38a0cb1d
Size

2.0MB
MD5

9b1697d40dfd386fdd7e9327844f301a
SHA1

e75defb119e2c7b7d3f75ab70a100ec504af5ebf
SHA256

69e7b08c127dde5fd1f85e1e8107d06aa686e94aef3fd48ff0bb092b38a0cb1d
SHA512

3e945bf24ed81fdc49e974d086a70f9758a17b8656bb0e460dca0be2a84fa0ba065b62b6dd5d55ca1dbe0b4f19ec4f164df84c115244f1cbfddd79611d013d69
SSDEEP

49152:aUqYHHS1dcYEOzB2kUIlcgG4X86p/IH9B99d7knHN:aUbSJEmtUIlnGu844B9P7knHN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
69e7b08c127dde5fd1f85e1e8107d06aa686e94aef3fd48ff0bb092b38a0cb1d

Files

69e7b08c127dde5fd1f85e1e8107d06aa686e94aef3fd48ff0bb092b38a0cb1d
.dll windows:5 windows x86 arch:x86

a718a920dee8f24278e62727b0fc2c6e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wintrust

CryptCATCDFEnumMembers

ws2_32

WSAGetLastError

kernel32

FindVolumeMountPointClose
GetBinaryTypeA
GetProcessHeap
InterlockedPushEntrySList
GetModuleHandleA
LoadLibraryW
GetProcAddress
GetModuleFileNameA

user32

RealGetWindowClassA
UpdateWindow

winmm

midiOutReset

gdi32

GetBkColor
SelectClipPath

rpcrt4

RpcServerUseAllProtseqsIf

Exports

Exports

NntioverTdeem

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

HoPJzxm
Size: 920KB - Virtual size: 919KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 848B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ