5dcb7714dccf2062f1f34e87a71981d02377b8b1d7e1d881700ea7cf94447db6 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5dcb7714dccf2062f1f34e87a71981d02377b8b1d7e1d881700ea7cf94447db6
Size

188KB
MD5

4b00ce1a52daaa0651ecc3c988d0b167
SHA1

6b2ebb4952bf187938649010d07ef69539e5e2ac
SHA256

5dcb7714dccf2062f1f34e87a71981d02377b8b1d7e1d881700ea7cf94447db6
SHA512

f93623549da75565ad95765b3c76e0aaf00985ea8ed7ab300e5b475b7b4d929289492497d91c6846ad144aa5ebef098055de1d61b51dee6fc4ed373b743a25bc
SSDEEP

3072:st1lNCvWNelQk0wvfKG+wiDYdgmoZQBmPjcicIPcXpzpx/ttr1A:st1/IcwdTiDYdgSUPQicIIpzpxFtr1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5dcb7714dccf2062f1f34e87a71981d02377b8b1d7e1d881700ea7cf94447db6

Files

5dcb7714dccf2062f1f34e87a71981d02377b8b1d7e1d881700ea7cf94447db6
.dll windows:5 windows x86 arch:x86

12e30a4970af4cc77d5c6e2437bc7800

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mprapi

MprInfoDelete
MprAdminMIBServerDisconnect

kernel32

GetModuleFileNameA
CloseHandle
BackupWrite
GlobalSize
OutputDebugStringA

shlwapi

PathRemoveBlanksA

crypt32

CryptStringToBinaryA

msvcrt

memset

ws2_32

accept

user32

FindWindowExA
GetWindowThreadProcessId
TranslateMessage
wsprintfA

advapi32

RegOverridePredefKey
AddUsersToEncryptedFile

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 133KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ