c68635d867cbb3465d3ac1b2a6aca617 | Triage

Sharing

General

Target

c68635d867cbb3465d3ac1b2a6aca617
Size

29KB
MD5

c68635d867cbb3465d3ac1b2a6aca617
SHA1

d9df22be318e6abd51ce32c092ad17078c173052
SHA256

ddcde248040742ede7f18237d5ae57be6d884a693b0da8fe5826240fd88de07e
SHA512

ba249e40f887b5b4af4aff0e56dc877f2c8da82b15896cb7c1c4520c1f08781818af5dda671a6220e4da36f45bac39c90804df5255f7fd66f7924f505720c841
SSDEEP

384:pCJIWi1r6r+LkAILkeKYpnbK7sUy8mWQ4jloEobK8lts2DZQNeHyZmW2WauW9mzb:pS51GIYX4nbK7c8mzHr102DZ6f3nEy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c68635d867cbb3465d3ac1b2a6aca617

Files

c68635d867cbb3465d3ac1b2a6aca617
.dll windows:5 windows x86 arch:x86

f0fe75fa175937b8937ac1ff544acf74

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

CallNextHookEx

ntdll

RtlFreeAnsiString

Exports

Exports

getActiveDesktop
getSpecials
getSplit
getWnd

Sections

.text
Size: 24KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE