b8b4a7582a7a1ca060ce88bd022373f5 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b8b4a7582a7a1ca060ce88bd022373f5
Size

2.4MB
MD5

b8b4a7582a7a1ca060ce88bd022373f5
SHA1

92f3c434a67094eaa2737eddc9ef2040f934a6bb
SHA256

cf902c20b7a89e360315a36885c7931bd0b34dd0edfd936e8123601baf9c1533
SHA512

c49d0dc1a80bd535d7f47c478bd7dc738a58fa9fccf002c0218cfd178d548320c089b4fc45661bc6757f6324338c926e33b5f5601b1414ef8b33464443a78aec
SSDEEP

24576:aYcEyB9xfuTIhRHK3kOHV38/VZotrnL9fBDzr5VDaeToj9ygOVTj3EcD4ZzwFdBr:aYcDE6Rruxgmrn5fkFOzVBZ/HIs48vd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b8b4a7582a7a1ca060ce88bd022373f5

Files

b8b4a7582a7a1ca060ce88bd022373f5
.dll windows:4 windows x86 arch:x86

a9e8c69161bf411181312cbdcf8dbbbb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentProcess
Sleep
GetModuleFileNameA
CloseHandle
SetEvent
GetPrivateProfileStringA
IsBadReadPtr
GetFileSize
ReadFile
SetFilePointer
CreateFileA
HeapAlloc
GetProcessHeap
VirtualProtect
TerminateProcess
GetProcAddress
GetModuleHandleA
LoadLibraryW
MultiByteToWideChar
LoadLibraryA
OpenEventA
CreateEventA
CreateThread

user32

SetWindowsHookExA
CallNextHookEx
wsprintfA
wvsprintfA
BroadcastSystemMessageA

msvcrt

_except_handler3
_strcmpi
_adjust_fdiv
strcpy
strcat
strlen
memset
strncpy
free
malloc
memcpy
strrchr
realloc
strstr
_strlwr
_initterm

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ