cbe9e4fd4777fc6ae3d4c5f9d3b2d62e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cbe9e4fd4777fc6ae3d4c5f9d3b2d62e
Size

34KB
MD5

cbe9e4fd4777fc6ae3d4c5f9d3b2d62e
SHA1

9643be168ec7b2bddde792d65d5a9c83d3bb8725
SHA256

d2e03e3486ca6b6b77654a97217f219b340f323c1e3f18ba2080032ec47c7b9b
SHA512

b377a787c8d52ae5a0a542c40a35a1931e9194410f5a205529682964a20f5d8f8e49de0c6e4d10c0182d1c0f4c382b646d4c7afcc84f14123c440b8fcfeacf9f
SSDEEP

768:ZijFs6TiQ6tYlH9gxuLVtW6m6F3x3nEQJRGkvyCuN:ZijlHL5tU6FBXNRq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cbe9e4fd4777fc6ae3d4c5f9d3b2d62e

Files

cbe9e4fd4777fc6ae3d4c5f9d3b2d62e
.dll windows:4 windows x86 arch:x86

4d208d18a2d9e7af9a4398ecd000d6ca

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

strcpy
_wcsnicmp
_strlwr
strcmp
RtlImageDirectoryEntryToData
RtlImageNtHeader
RtlGetCurrentPeb
RtlEqualUnicodeString
memcpy
strstr
sprintf
strncpy
memset
strcat
strlen
_strnicmp
wcsstr
_wcslwr
_chkstk

kernel32

MoveFileA
LeaveCriticalSection
HeapFree
HeapReAlloc
HeapAlloc
HeapCreate
VirtualFree
VirtualAlloc
DeleteCriticalSection
TerminateThread
CreateThread
CreateMutexA
InitializeCriticalSection
LoadLibraryA
GetModuleHandleA
ExitProcess
GetModuleFileNameA
CreateFileA
GetFileSize
ReadFile
CloseHandle
WriteFile
GetTempPathA
GetLastError
DeleteFileA
GetSystemDirectoryA
MultiByteToWideChar
Sleep
OutputDebugStringA
EnterCriticalSection
VirtualProtect
WideCharToMultiByte
DisableThreadLibraryCalls

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ