baffb169a9c4e0c9bbf9052cd64b4598 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

baffb169a9c4e0c9bbf9052cd64b4598
Size

24KB
MD5

baffb169a9c4e0c9bbf9052cd64b4598
SHA1

a6a670a249923ad9840c7115a5aec3410c5df5c8
SHA256

d6a21b44b81666c48a6c5ec0d168465d54b910ccd02dd5863beee3cb3f07c68f
SHA512

554142244f9f375e43b49169cd015bbdbf141cef2ba6aa383b974a8c283d17feca6edb02568947bb45e6862d46e919512e2d735b2b8319bb87b6f7ff8fa21a48
SSDEEP

192:njtMiEEnBKOEytOBUIpqin8jUilfwuXNzBGT8ZVpct5UACcZu8+PZ/:nZTEEnHKpqinY5BG8ZVpct5z0t

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
baffb169a9c4e0c9bbf9052cd64b4598

Files

baffb169a9c4e0c9bbf9052cd64b4598
.dll windows:4 windows x86 arch:x86

97203822b5490304f4173c5641f883b3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

GetWindowTextA
FindWindowExA
FindWindowA
EnumChildWindows
EnableWindow

ws2_32

ntohs
closesocket

msvcrt

free
_initterm
malloc
_adjust_fdiv
_itoa
strcmp
atoi
strcpy
memcpy
??3@YAXPAX@Z
??2@YAPAXI@Z
strstr
rand
fopen
fwrite
fclose
fread
time
memset
_strlwr
srand

kernel32

IsBadReadPtr
GetModuleFileNameA
GetModuleHandleA
GetTickCount
lstrlenA
CopyFileA
CreateThread
GetTempPathA
LoadLibraryA
GetProcAddress
VirtualAllocEx
GlobalAlloc
GlobalLock
CreateRemoteThread
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory
Sleep
lstrcmpA
lstrcpyA

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 780B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ