a48d0ac0fa63b1bf3fd3f9efb7cb0ef48a7bcf4fdfaf4018b9695dd9e9e06197 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a48d0ac0fa63b1bf3fd3f9efb7cb0ef48a7bcf4fdfaf4018b9695dd9e9e06197
Size

11KB
MD5

bdc2fb84577b1c6985b8b096177cd753
SHA1

71dabb935b468f437f498c73ff07cd2a9b695227
SHA256

a48d0ac0fa63b1bf3fd3f9efb7cb0ef48a7bcf4fdfaf4018b9695dd9e9e06197
SHA512

6197f346e41fc9904370e5246103d10cfbb400301e337a4e719637fca04dda2fa54b970c6abfa223d16ecaf9f0a7e5f361c4c0a97d5414adeabbd50eec812586
SSDEEP

192:58d30qZewxjtYOyktEh8wE7J0XLdunZId3Ad31G8P14Mdy:2kq9ylktESx7J0X4y3Ad3DPJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a48d0ac0fa63b1bf3fd3f9efb7cb0ef48a7bcf4fdfaf4018b9695dd9e9e06197

Files

a48d0ac0fa63b1bf3fd3f9efb7cb0ef48a7bcf4fdfaf4018b9695dd9e9e06197
.dll windows:6 windows x86 arch:x86

1a7500611b2c1210cdc4f5fed2577476

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

memset
memcpy
wcscpy_s
wcsstr
_errno

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo

kernel32

IsWow64Process
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
CloseHandle
GetLastError
SetLastError
HeapAlloc
HeapFree
GetProcessHeap
GetCurrentProcess
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
IsProcessorFeaturePresent
DisableThreadLibraryCalls
FreeLibrary
LoadLibraryExW

user32

CharLowerW

shlwapi

PathRemoveFileSpecW

Exports

Exports

DoDllProcAny

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 940B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ