d5dca1755ba6d61c63f72f40a64d120b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d5dca1755ba6d61c63f72f40a64d120b
Size

11KB
MD5

d5dca1755ba6d61c63f72f40a64d120b
SHA1

db92a9f65af8a8a15d5b94fa0e821fc60bd1d359
SHA256

dcd83f69e0252c7be89da1ce9f247d50f769a02caac6138c3633944af10584a2
SHA512

bfd0db5f46fe0547ce2c040a9ad74059d8c6d2a0a3e27131e59cca4f69caad8712f199fe291ff5ff797531c35e1f67342c57065842ac91bb4ed24a9a460ece78
SSDEEP

192:nMPokLCOi1vHVg4q36HdW6VWbf1im90wGknb6VCSrz7mxLoX:nMPokuhxn9W6VWDMm90PknqrzSNo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d5dca1755ba6d61c63f72f40a64d120b

Files

d5dca1755ba6d61c63f72f40a64d120b
.dll windows:5 windows x86 arch:x86

9e6f42c96ba23b37638951e606eb2d21

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

UnhookWindowsHookEx

ntdll

RtlFreeAnsiString

Exports

Exports

getSpot

Sections

.text
Size: 5KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE