c155e268a309f0a7ab9fe02c5e221784 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c155e268a309f0a7ab9fe02c5e221784
Size

17KB
MD5

c155e268a309f0a7ab9fe02c5e221784
SHA1

8e815724b96fde498e1dca44921c9eda05bcaf70
SHA256

bddb3cd78e00d5d84e67816dd396802625b9c52300fc9c11563b4d49f0b0ed07
SHA512

b7eb4d8cd7c098c100c86668597e76bca6bdb3a4b9c1a0653dab95c17583e74f03e05dd080cc85f1b2c5c53bc0df08b1b3e0ced310a910bdd41e4e076e0d597a
SSDEEP

384:pN44QPc1vR04GbeDHjt0IGhddU2Bzq9W9fWh:pN447qgtC76EBQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c155e268a309f0a7ab9fe02c5e221784

Files

c155e268a309f0a7ab9fe02c5e221784
.dll windows:4 windows x86 arch:x86

9260fe964e5a68fd7603e0ba6c85f6f3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcatA
GetSystemDirectoryA
FreeLibrary
GetTempPathA
GetWindowsDirectoryA
CreateMutexA
GetCurrentProcessId
LoadLibraryA
DisableThreadLibraryCalls
GetCurrentProcess
Sleep
ExitProcess
CreateThread
GetProcAddress

user32

GetWindowTextA
GetForegroundWindow
FindWindowExA
wsprintfA
keybd_event
PostMessageA

advapi32

LookupPrivilegeValueA

msvcrt

fopen
printf
fscanf
fclose
??2@YAPAXI@Z

Exports

Exports

CompareLinkInfoReferents
CompareLinkInfoVolumes
CreateLinkInfo
CreateLinkInfoA
CreateLinkInfoW
DestroyLinkInfo
DisconnectLinkInfo
GetCanonicalPathInfo
GetCanonicalPathInfoA
GetCanonicalPathInfoW
GetLinkInfoData
IsValidLinkInfo
MSCON
ResolveLinkInfo
ResolveLinkInfoA
ResolveLinkInfoW

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 802B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ