d59ee0c375e2bc8f8daf5a51403458a8 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d59ee0c375e2bc8f8daf5a51403458a8
Size

19KB
MD5

d59ee0c375e2bc8f8daf5a51403458a8
SHA1

6b7b977cd0cbf04c03dbfcdbb40d2461a6f06728
SHA256

4a177a7f2bf76391ea735055ccb1b9e0ceb002c406673588b31b30aa0a68e1f5
SHA512

d3fbf3f288de612c0ae11f657558a2f0f196692b075d4698b61218f2466af7dcfa3c9417cb7bdfdd7b19f27472b6c78ede50fd05dd97591a094978d633fd5348
SSDEEP

192:mD1S+h3ibTomYNnUiU4MYTwvTFDu4m0UnzRvgpgr4rR8/SlY3r1lXh/////////Y:01SDbUmqp8TcZzlcO3r1FpI7v

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d59ee0c375e2bc8f8daf5a51403458a8

Files

d59ee0c375e2bc8f8daf5a51403458a8
.dll windows:4 windows x86 arch:x86

48cc11b5eeb642812df5e9171aa6b7ec

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

WSACleanup
WSAStartup
recv
closesocket
send
gethostbyname
htons
socket
connect

kernel32

CloseHandle
OpenEventA
SetEvent
VirtualQuery
CreateThread
GetTickCount
lstrcatA
lstrlenA
GetWindowsDirectoryA
GetSystemDirectoryA
lstrcmpiA
lstrcpyA
lstrcpynA
GetSystemTime
GlobalFree
GlobalAlloc
lstrcmpA
DeleteFileA
GetTempFileNameA
GetTempPathA
WinExec
GetModuleFileNameA
RtlUnwind
WriteFile
CreateFileA
CreateProcessA
GetLastError
FileTimeToSystemTime
FindClose
FindFirstFileA
GetComputerNameA
Sleep
CreateMutexA
ExitProcess

user32

SetWindowsHookExA
CallNextHookEx
SendMessageA
CharLowerA
wsprintfA

advapi32

RegCreateKeyA
RegQueryValueExA
RegCloseKey

Exports

Exports

Activate

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 554B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ