d450504d5d13cc0bc3dbb36f2c6241df | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d450504d5d13cc0bc3dbb36f2c6241df
Size

7KB
MD5

d450504d5d13cc0bc3dbb36f2c6241df
SHA1

f7c7141ff0ea9380cda45a217f234465bcc9d227
SHA256

e4792a7b23a201bd7a3662cd42e1c33c1bcdc9822067906ffb1b748953dca8d0
SHA512

6eeb6969a14d240f78251d6d5d0a9aabb2164896d611cd5dad7289b4dc316c8721c387e63fe4644008ca998bdab834ce75d5c7ddcc6892b695abb64554c92a42
SSDEEP

96:Tu5GuoZADj24Wn6qswEtQPUVvSMQysOclI+HbsKgzuLCK9Wun20MbzSffzt95:TpvrJjUVSbnlRbsKquWD0MbsfB9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d450504d5d13cc0bc3dbb36f2c6241df

Files

d450504d5d13cc0bc3dbb36f2c6241df
.dll windows:4 windows x86 arch:x86

beb34b89a61475bfc94c0de8a9ea7918

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcatA
FindClose
FindFirstFileA
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
lstrlenA
OpenProcess
GetWindowsDirectoryA
ReleaseMutex
GetLastError
CreateMutexA
FindNextFileA
Sleep
lstrcpyA
lstrcmpiA
GlobalAlloc
Process32Next
Process32First
CreateToolhelp32Snapshot
CreateThread
GetCurrentProcessId
VirtualAlloc
VirtualFree
ReadFile
GetFileSize
CreateFileA
GetCurrentProcess
GetModuleFileNameA
LoadLibraryA
GetProcAddress
CloseHandle

user32

wsprintfA

advapi32

OpenProcessToken
AdjustTokenPrivileges
LookupAccountSidA
GetTokenInformation
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
LookupPrivilegeValueA

msvcrt

memcpy
_strlwr
sprintf
strstr
strcpy
strcat
_except_handler3
memset

Sections

.bss
Size: - Virtual size: 576B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 748B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ