d592dfde3ec5ade7bfc8dae59f68366d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d592dfde3ec5ade7bfc8dae59f68366d
Size

92KB
MD5

d592dfde3ec5ade7bfc8dae59f68366d
SHA1

371a7ef852c3dfb2664d84cda7a8b47d390cec62
SHA256

30ae52297ebeff3cf5f9a3daefbde9a13ed47dfdcf9cf9c5f00abf9fc5d34b93
SHA512

2edcc398743c59b9a09d94008f7eaf3ef4ea863db03d4440151da099adaa31225e19e4ea8c8d732c38c9c97550207bb3a8991157e5de48827a618ef93355ac01
SSDEEP

1536:sidwAVI9FiR8PxP2RP4u91LSkUHjRkWdKQ0L6FGAkYOZfegoZRr:l3I9MRqPuZBENkW0QGKkYnHZN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d592dfde3ec5ade7bfc8dae59f68366d

Files

d592dfde3ec5ade7bfc8dae59f68366d
.dll windows:4 windows x86 arch:x86

5732a7281bee18ec9c738faf63744436

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

ninittonhe.pdb

Imports

advapi32

ReadEventLogW
ImpersonateSelf
OpenThreadToken
OpenProcessToken
CloseEventLog
CheckTokenMembership
LookupPrivilegeValueW
AllocateAndInitializeSid
AdjustTokenPrivileges
LookupAccountNameW
RevertToSelf
LookupAccountSidW
OpenEventLogW
LookupAccountSidA
EqualSid

Exports

Exports

mxqw

Sections

.text
Size: 64KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 498B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ