bb7088bd7c7fd3a8861511fbf675afad | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bb7088bd7c7fd3a8861511fbf675afad
Size

12KB
MD5

bb7088bd7c7fd3a8861511fbf675afad
SHA1

592ced687b3b1b07215b4d9a7ec857a6db61f7a7
SHA256

986eddc303febcf0801de50458a3d1406296d1757342db4a65663152e0f2fa7a
SHA512

9a8141fc55c05ff40693f138013b713083bd660fc81b338c4635a62260b61d4f0700466b1d10f62aeec169d70ca7a7155bdfd5292e39063be1ca7d25f99bc95a
SSDEEP

192:USIRwoijqtAxCElToPSUN4NA2HOs1LOzRnmLTSswPic2JFUEU9ZJaGx/PCl3B:USIRgGtIJSCCBZlmLiqcnD9fJx63B

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bb7088bd7c7fd3a8861511fbf675afad

Files

bb7088bd7c7fd3a8861511fbf675afad
.dll windows:4 windows x86 arch:x86

279e070c1e803df4f1d4207614e8c3d5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
CompareStringA
IsBadReadPtr
LoadLibraryA
GetModuleFileNameA
GetProcAddress
lstrlenA
MultiByteToWideChar
CreateThread
GetTickCount
GetCurrentProcessId
GetCurrentThreadId
VirtualProtect
GetProcessHeap
HeapAlloc

user32

GetForegroundWindow
UnhookWindowsHookEx
GetMessageA
DispatchMessageA
KillTimer
SetTimer
GetClassNameA
CallNextHookEx
wsprintfA
SetWindowsHookExA

msvcrt

strncpy
wcslen
_wcsnicmp
__CxxFrameHandler
strncmp
strchr
_except_handler3
strrchr
strstr
_local_unwind2

shlwapi

StrCmpNIA

oleaut32

VariantClear
SysAllocString

ole32

CoUninitialize
CoInitialize
CoCreateInstance

wininet

InternetOpenA
InternetReadFile
InternetCloseHandle
InternetOpenUrlA

ws2_32

ntohs
getpeername

Sections

.text
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 956B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ