d51ef702781ba8640c19e31290aa7e80 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d51ef702781ba8640c19e31290aa7e80
Size

24KB
MD5

d51ef702781ba8640c19e31290aa7e80
SHA1

f28e1d6d0d648c63abf5c717a7e4983a11920a63
SHA256

9898f9a0d075424881da337ca71e96afe56cb99800490c00a2f42cf68abbac3f
SHA512

7db1970f532d949f49b208bfaf64ad3461bf4047f9013990a77104061748b3ab6e0d816cd55e7394bc390596e7088b1e00305d833cc1ba05bccbd94925103e32
SSDEEP

384:mQyl4mmjgMFUJcoFFvyxJHxXpct5FdKY:fYmpUC/JHRat5FdT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d51ef702781ba8640c19e31290aa7e80

Files

d51ef702781ba8640c19e31290aa7e80
.dll windows:4 windows x86 arch:x86

64ff15a451e813cbd0e379590e001ffc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

GetClassNameA
GetWindowThreadProcessId
EnumWindows
EnumChildWindows
GetWindowTextA
SetWindowTextA

msvcrt

free
strchr
malloc
_adjust_fdiv
_strupr
strcmp
atoi
memcpy
strstr
fopen
fwrite
fclose
fread
time
memset
??2@YAPAXI@Z
??3@YAXPAX@Z
_strlwr
_itoa
_initterm

kernel32

Sleep
LoadLibraryA
CopyFileA
ExitProcess
lstrcmpA
GetCommandLineA
GetProcAddress
GetModuleFileNameA
CreateThread
GetTempPathA
lstrcpyA
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory
lstrlenA

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 826B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ