bd4433bf847b3a42aa799e333f500aa8 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bd4433bf847b3a42aa799e333f500aa8
Size

9KB
MD5

bd4433bf847b3a42aa799e333f500aa8
SHA1

3d98d511489a9f751a068d178e9ffa865396a434
SHA256

3a05c2ad0fb480d4feb8585d57674c9c6e7573b6679833c2d4ec8fa4f6ab883b
SHA512

46c7cf21a0bec6b0a4069ee3ecb50e57fe34b07b65d0459599628784d3983509240047780deed8ea9360a2dad439672b59e62a6cee516df3911a45430838d715
SSDEEP

192:YmHu9nuHvoIoJ2s3+wbAVow+Dlfh6ofgfTUj1mhy:HHuMHAn2O+e1DXiTUhMy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bd4433bf847b3a42aa799e333f500aa8

Files

bd4433bf847b3a42aa799e333f500aa8
.dll windows:4 windows x86 arch:x86

38ea03c5f8620e59e0b4b065a9f0b033

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wsock32

WSAStartup
socket
closesocket
gethostbyname
htons
connect
send
recv
WSACleanup

kernel32

CloseHandle
CreateToolhelp32Snapshot
Process32First
OpenProcess
TerminateProcess
Process32Next
lstrcmpiA
GetModuleHandleA
GetProcAddress
Sleep
lstrlenA
lstrcatA
lstrcpyA
WriteFile
CreateFileA

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 624B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 262B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ