b6a8e166f5364cf37bc62f18e40d5a96 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b6a8e166f5364cf37bc62f18e40d5a96
Size

92KB
MD5

b6a8e166f5364cf37bc62f18e40d5a96
SHA1

719221d5e3c4bac39a7762d947e5cdcdaf0ef8dd
SHA256

bc89fcd28127f92c4d38c1873b5481d53b6c72def6b308a559b1618d0ff346b3
SHA512

0678393467807ffb26e175eab59ce64cfa1f684773d5f2e3f5366ab2780ee44b4c5f39034356ee4a0f879be322fc17416ab9744dfb97151c838268187a5faf92
SSDEEP

1536:kLm7mOn0UUUM1D6t5OYcCUZr046tsjz3ykn9EToBwG37LzB8HQR:kL/O341mt5OYcCW046tkz3QoBwG37LzZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b6a8e166f5364cf37bc62f18e40d5a96

Files

b6a8e166f5364cf37bc62f18e40d5a96
.dll windows:4 windows x86 arch:x86

65abd7392341657a83019a4aea37278a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

debug.pdb

Imports

kernel32

EnumCalendarInfoA

user32

MessageBoxExA
CharPrevA
wsprintfA
MessageBoxA
CharNextA
LoadStringA

advapi32

InitializeSid
RegCloseKey
SetSecurityDescriptorDacl
AllocateAndInitializeSid
FreeSid
GetSecurityDescriptorDacl
RegEnumValueA
RegQueryValueExA
GetSidSubAuthority
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
RegOpenKeyExA
GetSidLengthRequired

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

shell32

SHGetMalloc
SHGetSpecialFolderLocation
SHGetPathFromIDListA

Exports

Exports

aafendzrk

Sections

.text
Size: 60KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 470B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ