bf99799e8c40564c5137990554687b3b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bf99799e8c40564c5137990554687b3b
Size

176KB
MD5

bf99799e8c40564c5137990554687b3b
SHA1

40696e87022fb79522f4b3832b1f267d86895fe1
SHA256

55d2f56a932876ed2c9503548142802b40307fe103c184d01b63c7ca16d0d42c
SHA512

da48e6ee33be555124b006254fc057cbcae4bf82aa8f606e66ffee01b18643247d07cc551f9377ef82965c04fda7d1511c2e418e07dfbaf98b6f2074762a6376
SSDEEP

3072:9Kkp428WjjwXsflhrBeyDizPwZ/siyw/1mhY:9Kkp4XcflhQjOhtd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bf99799e8c40564c5137990554687b3b

Files

bf99799e8c40564c5137990554687b3b
.dll windows:5 windows x86 arch:x86

ecea31a9a05204c9f1428db4ffb56ccd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

RegOverridePredefKey
AddUsersToEncryptedFile

msvcrt

memset

ws2_32

accept

mprapi

MprAdminMIBServerDisconnect
MprInfoDelete

winspool.drv

AddMonitorW

kernel32

CloseHandle
GetModuleFileNameA
OutputDebugStringA
BackupWrite
LocalFlags

crypt32

CryptStringToBinaryA

user32

FindWindowExA
TranslateMessage
GetWindowThreadProcessId
wsprintfW

shlwapi

PathRemoveBlanksW

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 123KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ