d6388ab72cedda8b5d5ad962a1ef6b5e | Triage

Sharing

General

Target

d6388ab72cedda8b5d5ad962a1ef6b5e
Size

50KB
MD5

d6388ab72cedda8b5d5ad962a1ef6b5e
SHA1

d61f62ef8ae421bf2938f46aa25421fa91c6547a
SHA256

2226b58ec885fc416eb6755dcfae32d88786b88d88d09e254cf3402a9037698c
SHA512

4e54fed81ee7831a526b44395e18eab5385ccb7c0468ff0b98b4bbbcbcdec2557164440f38e4dff144216cf3571194a32c4c50b4ed20f087743e361c088d2f08
SSDEEP

1536:AqZ6iyF48gzhTuXc61PjkxWeTXN7A5ZUf:pZ8m8+X1/7NMZg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d6388ab72cedda8b5d5ad962a1ef6b5e

Files

d6388ab72cedda8b5d5ad962a1ef6b5e
.exe windows:4 windows x86 arch:x86

1e09b6e52a9e73f1a064a71627dfb007

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\hobot\dll\dll_loader\Release\dll_loader.pdb

Imports

urlmon

URLDownloadToFileA
URLDownloadToCacheFileA

kernel32

HeapAlloc
GetProcessHeap
GetFileSize
GetTickCount
WriteFile
SystemTimeToFileTime
GetSystemTime
GetFileTime
CreateProcessA
CloseHandle
WaitForSingleObject
CreateMutexA
MoveFileA
DeleteFileA
GetSystemDirectoryA
ReadFile
SetFilePointer
CreateFileA
GetModuleFileNameA
GetWindowsDirectoryA

advapi32

RegCreateKeyExA
RegQueryValueExA
RegCloseKey

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 1007B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ