e006703c149b6fd1e1ca718789afcc83 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e006703c149b6fd1e1ca718789afcc83
Size

6KB
MD5

e006703c149b6fd1e1ca718789afcc83
SHA1

9040fc1522bda6e0f244226c82fad81a97ee6485
SHA256

71f0b4dbf57116ee0ae17a96717ed0f758fb0a4fb58e53a5714e850856c9e290
SHA512

9dd472f43124f8ad97fcb360f27bbabdd15719eb057ef5645d8e04d957818d43d4a2a3e1a50b518f9f44464ac8696ac1042805ef4da6cc4f29eea4643d2d5987
SSDEEP

96:BWfmfBBXNJfh4JGcKtreLWhdNod4+uGkpih7ihluMeZLkLgP:hxdNMUCEluFZLkLg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e006703c149b6fd1e1ca718789afcc83

Files

e006703c149b6fd1e1ca718789afcc83
.dll windows:4 windows x86 arch:x86

7dfedfcbb2ebe28b76fbb47692b0ffda

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateThread

user32

GetWindowTextA
EnumWindows
SendMessageA
GetClassNameA
CallNextHookEx
EnumChildWindows
GetParent
SetWindowsHookExA
UnhookWindowsHookEx

ws2_32

WSACleanup
send
connect
gethostbyname
inet_addr
htons
socket
WSAStartup

Exports

Exports

StartHook
StopHook

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 558B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.shared
Size: 512B - Virtual size: 332B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 232B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ