d42835cd582b7353779d37b428515013 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d42835cd582b7353779d37b428515013
Size

32KB
MD5

d42835cd582b7353779d37b428515013
SHA1

a1012b1876d61b0fb2261d4750371d10b9069521
SHA256

f4c9400b3a90ef75b2577cfcf2ca8c703b418637a215ef2c22db9fd6b44cb944
SHA512

5fd9ecf796a1ee3612de251cfabe8d8fd734889099d1a098322c546660ba6a360be34f7906f529b14abac43d0d2b20f64a369999b7a5314c089b3d9ad2114e71
SSDEEP

384:3SzKmi7YAFh4aAHRkvVm4j+jAzLjB+wpZQpaznr1LBMwgBi:9mkhz4Rkg4j+j+LjUwpZQpaznxLBHMi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d42835cd582b7353779d37b428515013

Files

d42835cd582b7353779d37b428515013
.dll windows:4 windows x86 arch:x86

ce3109d55eb4129aeaa4986cae91e546

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

GetWindowTextA
GetWindowThreadProcessId
EnumWindows

ws2_32

closesocket
ntohs

msvcrt

strchr
srand
_initterm
malloc
_adjust_fdiv
_itoa
memcmp
atoi
memcpy
??3@YAXPAX@Z
??2@YAPAXI@Z
strstr
fopen
fwrite
fclose
fread
time
memset
rand
_strlwr
free

kernel32

Sleep
CreateThread
CreateEventA
WaitForSingleObject
GetTickCount
SetEvent
LoadLibraryA
CopyFileA
GetProcAddress
GetModuleFileNameA
GetTempPathA
lstrcmpA
lstrlenA
lstrcpyA
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
GetModuleHandleA

Sections

.text
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ