b445384c905cd279036c47aad5b91943 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b445384c905cd279036c47aad5b91943
Size

28KB
MD5

b445384c905cd279036c47aad5b91943
SHA1

2f50df4898698416b48895c09436dc7aba47c8b2
SHA256

a42615489ec0a0256f4c1c31b9d625cfeaf9e9f5062afb0caf79509c10f7461b
SHA512

bc02f5ed809a841f70166f2e4782d1285e4ff24896e1527c6a85655ef8b473e2574b55af98f18d88c0a7e2a371b63659b0a74502611de81f9e5971ebb14da3a3
SSDEEP

192:72zyxekVtwi3MJs5wKPfEQBu4PfuBBQ6PRQkn8vs1Pm:aVI95v1B3fuBBQARQkys1Pm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b445384c905cd279036c47aad5b91943

Files

b445384c905cd279036c47aad5b91943
.dll windows:4 windows x86 arch:x86

f23f2946fe492af6786715eb1de66ebb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
CreateFileA
CreateThread
GetCurrentProcess
GetCurrentProcessId
GetExitCodeThread
GetFileSize
GetModuleFileNameA
GetModuleHandleA
GlobalAlloc
GlobalFree
ReadFile
ReadProcessMemory
RtlZeroMemory
Sleep
VirtualAlloc
VirtualFree
VirtualProtectEx
VirtualQueryEx
WaitForSingleObject
WriteProcessMemory
lstrcatA
lstrcmpA
lstrcmpiA
lstrcpyA
lstrcpynA
lstrlenA
GetProcAddress
LoadLibraryA

user32

GetWindowLongA
GetWindowTextA
GetWindowThreadProcessId
EnumWindows
SetTimer
SetWindowLongA
CallWindowProcA
KillTimer
wsprintfA

wininet

InternetOpenUrlA
InternetOpenA
InternetCloseHandle

msvcrt

memcmp
memcpy

ws2_32

send

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 510B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ