be9ec6c3db27b5863b7822bfb8e0b663 | Triage

Sharing

General

Target

be9ec6c3db27b5863b7822bfb8e0b663
Size

24KB
MD5

be9ec6c3db27b5863b7822bfb8e0b663
SHA1

12af00a475a76a73389be8c2db88b30cccb95170
SHA256

ebb1126a2646488789083a31101fb2b4a5841bfb330d07853c94d976afe5c19b
SHA512

b04aee612264a1d63fe6496c0ed10ee47a118060f99775b0fb28ebb6e2343e13b04244588d90decc2dd3376e9aad306283e2864c6691d57d1ce7a98d5c561ea2
SSDEEP

192:cPauBHCyraENYnwdEk5PpGjR5lqpct5UfMy1:cZ5XNmWbpwR5lqpct5KM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
be9ec6c3db27b5863b7822bfb8e0b663

Files

be9ec6c3db27b5863b7822bfb8e0b663
.dll windows:4 windows x86 arch:x86

bbb84c15352f7195137c736357677e1e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

memset
_adjust_fdiv
malloc
_initterm
free
strchr
atoi
memcpy
strcmp
??3@YAXPAX@Z
??2@YAPAXI@Z
strstr
fopen
fwrite
fclose
fread
time
_strlwr
_itoa

kernel32

WriteProcessMemory
ExitProcess
Sleep
GetModuleHandleA
CreateThread
lstrlenA
LoadLibraryA
CopyFileA
GetProcAddress
GetModuleFileNameA
GetTempPathA
IsBadReadPtr
lstrcpyA
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx

Sections

.text
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 894B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 532B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ