b781425694f365208641e26173b997bd | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b781425694f365208641e26173b997bd
Size

28KB
MD5

b781425694f365208641e26173b997bd
SHA1

4313efd9236023b6e21454757206867db8bd9889
SHA256

6d21b31d56682f472bb80b5b9452ba06c05fa32fe42b8cd8c39557b7422f2334
SHA512

4c272934372a86025fd98dedcfd6072d12ec131504a6415c9c115d9220b8464a9eb4b7696eb012a6b6e1a55cc05e3a3171f997b6a9fcdf953b020e8169ab3578
SSDEEP

384:qgOaHHTB8achFFqW3z+/AUDpYTkTNJjZaTRMAJSLuH38:qg/GxIW3zyB1YTkTNJtaTWDKHM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b781425694f365208641e26173b997bd

Files

b781425694f365208641e26173b997bd
.dll windows:4 windows x86 arch:x86

39e462307a06977df45b37fd70e2560c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

EnumWindows
GetWindowTextA
GetClassNameA
GetWindowThreadProcessId
SetWindowTextA
EnumChildWindows
SetForegroundWindow

ws2_32

closesocket

msvcrt

memcpy
free
_initterm
malloc
_adjust_fdiv
_strupr
strchr
strcmp
strstr
fopen
fwrite
fclose
fread
time
memset
??2@YAPAXI@Z
??3@YAXPAX@Z
_strlwr
_itoa
atoi

kernel32

LoadLibraryA
GetProcAddress
GetModuleFileNameA
WaitForSingleObject
TerminateProcess
GetCommandLineA
CreateEventA
lstrcmpA
Sleep
CreateThread
GetTempPathA
SetEvent
lstrlenA
lstrcpyA
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
CopyFileA

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ