c9f89061ba71ff53d5fbf49ccaa9c364 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c9f89061ba71ff53d5fbf49ccaa9c364
Size

9KB
MD5

c9f89061ba71ff53d5fbf49ccaa9c364
SHA1

5025d3b61b18d79ae285c7696744165dad6ed92a
SHA256

1dea404386de1fa9dba2176b9c44ca78c651ed911e4409ba39b80ba6bff4646c
SHA512

bb48a21fe0335df77f8725fb96f4983c1f745b12b06b134ec084e8a51afdb08c3fdd09fd9b06318f3955e630e656595aea437b6392d5bf97c2b7520fb0e1b093
SSDEEP

192:cF/0FuhEUkJDkoeDqtig+jB1YMjyDALYP7sKBA:cFsFo1kVkmt2jB2ayDALYPwh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c9f89061ba71ff53d5fbf49ccaa9c364

Files

c9f89061ba71ff53d5fbf49ccaa9c364
.dll windows:4 windows x86 arch:x86

993b8fe8b85cc8f02bfe5a06830a0ef2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_except_handler3
strrchr
strstr
free
malloc
strchr
strncpy
_initterm
_adjust_fdiv

kernel32

HeapAlloc
GetProcessHeap
VirtualProtect
CloseHandle
CreateFileA
CompareStringA
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
GetProcAddress
GetModuleHandleA
OpenProcess
GetCurrentProcess
lstrlenA
WideCharToMultiByte
MultiByteToWideChar
CreateThread
LoadLibraryA
ReadFile
GetFileSize
GetModuleFileNameA
FreeLibrary
FreeLibraryAndExitThread

user32

wsprintfA
GetWindowThreadProcessId
FindWindowA
SetTimer
KillTimer
TranslateMessage
DispatchMessageA
GetMessageA

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken

wininet

InternetCloseHandle
InternetReadFile
InternetOpenUrlA
InternetOpenA

Sections

.text
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 628B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ