d4845c417e79c2a69162cf1b1f3053f3 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d4845c417e79c2a69162cf1b1f3053f3
Size

22KB
MD5

d4845c417e79c2a69162cf1b1f3053f3
SHA1

887797eaee4cd8091ce070061ed7ffc3ad7781b2
SHA256

e194274a36c1d39746a9481e216aa7de8c70701c6f5c12ce906db966c97a1970
SHA512

0cad24849763c84956c720349c210b0f0d8a81d4e1ea1bf946efbcc6b40380640671fe75e8807bdf944ee54c3c25652cd3c9618c47be3f85bea791d7e844b0f8
SSDEEP

384:nugGQDQ8fHM7zaFlsWbZhidiHh/pkdAaj/T+E6Fz+ceiN3zc3Pu6NgYbgWDDW:XHVl9Ti8h/p8jLBdcH+3XNg8N

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d4845c417e79c2a69162cf1b1f3053f3

Files

d4845c417e79c2a69162cf1b1f3053f3
.dll windows:4 windows x86 arch:x86

18627ae854889350ab3beafd824f6551

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiA
Process32First
CreateToolhelp32Snapshot
OpenProcess
WaitForSingleObject
CreateRemoteThread
FreeLibrary
GetProcAddress
LoadLibraryA
GetVersion
WriteProcessMemory
VirtualAllocEx
Process32Next
ReadProcessMemory
VirtualProtectEx
VirtualProtect
GetModuleHandleA
DeleteFileA
lstrlenA
GetSystemDirectoryA
GetModuleFileNameA
HeapAlloc
GetProcessHeap
HeapFree
lstrcpyA
GetCurrentProcess
CloseHandle

advapi32

LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ