ab4044a34f6a85614f925aeac49be442 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ab4044a34f6a85614f925aeac49be442
Size

385KB
MD5

ab4044a34f6a85614f925aeac49be442
SHA1

c5b1ade11834d35a7ab1aed4d47adeeabcbda475
SHA256

f72de64c259748c8b6121e583c87515735972a65e1620e5533fbd516ce1d69e6
SHA512

c13bb1c99d6a79afa5bbe8d92b68d0d850dad61e92bdc23c7a857b9a6516529ba4b18e65a299b14df6cee89a902fc4a22cb11eb6b8aad64c6a2fab6bb378629e
SSDEEP

6144:4ka9kVrA+bOtPFI3gNfZVlNm6D1muRfBNcKFhD5nIWdwBV7NQ/lAapH6YhA37V:IWZbOpe3UZE6Dn/1hPdyVhQ/+aF6X7V

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ab4044a34f6a85614f925aeac49be442

Files

ab4044a34f6a85614f925aeac49be442
.dll windows:5 windows x86 arch:x86

decf7bc642a8182a47dc82c7fe2c2cc5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

oleaut32

SysFreeString

advapi32

RegQueryValueExW

user32

LoadStringW

msimg32

AlphaBlend

gdi32

UnrealizeObject

version

VerQueryValueW

mpr

WNetGetUniversalNameW

shfolder

SHGetFolderPathW

ole32

CreateStreamOnHGlobal

comctl32

InitializeFlatSB

winspool.drv

OpenPrinterW

Exports

Exports

CPlApplet

Sections

.text
Size: 375KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE