b674b38e90965f81666378c9146db152 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b674b38e90965f81666378c9146db152
Size

24KB
MD5

b674b38e90965f81666378c9146db152
SHA1

02e908580d8292ece5acd8007819a25fbf6da558
SHA256

1fa2df0946d6afb38347df001f5c185b1df22fb0ab1f1811bea21731651e1e52
SHA512

a347483abf8d6311b7e02a9396b052e9330bb9c9ed6eb53062b374e6c849f6b07ef7e91447be53f1f193f764d49386957ed0b821639f242c92f6ca2ad674a6cb
SSDEEP

384:wiIBkRo4yvbbllWBVceu9KgGJvWrK9Sm2umsBUqU:VIBqbyvOEOJu3sB9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b674b38e90965f81666378c9146db152

Files

b674b38e90965f81666378c9146db152
.dll windows:4 windows x86 arch:x86

2dc96adf3b1323a9aa57eb7c1c67a528

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

VirtualAlloc
VirtualFree
GetProcAddress
LoadLibraryA
GetCurrentThreadId
CloseHandle
CreateProcessA
GetTempPathA
VirtualProtectEx
ReadProcessMemory
GetCurrentProcess
TerminateProcess
Sleep
CreateThread
CreateFileA
WriteProcessMemory
GetModuleHandleA
GetModuleFileNameA
OutputDebugStringA
GlobalFree
GlobalLock
GlobalAlloc

user32

wsprintfA
GetMessageA
PostThreadMessageA
GetInputState
GetWindowTextA
FindWindowA
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx

wininet

InternetOpenA
InternetOpenUrlA
InternetCloseHandle

ws2_32

WSACleanup
gethostbyname
gethostname
WSAStartup

Exports

Exports

ZtGame_IN
ZtGame_OUT

Sections

.text
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.mdata
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 786B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ