d78ae901df9a932d59857c8feb83877c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d78ae901df9a932d59857c8feb83877c
Size

24KB
MD5

d78ae901df9a932d59857c8feb83877c
SHA1

df53abdffe579f0e96d8d73bfba2481bfaffe2b0
SHA256

af87f83e0405c27bae844d7253f6c15d97d700f43fc22dcaaf34e495377c4851
SHA512

cfd93d4ba1df25bded3294827f721e9f2c06a8113ddae99c01e1003beaa5ee456906b179786291ab7db57ab94cad7af25d4a755d651daa3bd113be3ce6fd98da
SSDEEP

384:tYyqlLS8tP8D3bvxy1h8Mw6makjyV6qZAfO6+hEC4gN+Et7P3VM+bKAa6DAX0LUB:uV4I1hRUaZV6q5phEC4gFnu6DKCsRT3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d78ae901df9a932d59857c8feb83877c

Files

d78ae901df9a932d59857c8feb83877c
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

StartHook
StopHook
pt_ksHook
pt_tzHook

Sections

CODE
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 512B - Virtual size: 236B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 2KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 129B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ