e074d63a480d7bf671b3eb9f373fe2c0 | Triage

Sharing

General

Target

e074d63a480d7bf671b3eb9f373fe2c0
Size

3KB
MD5

e074d63a480d7bf671b3eb9f373fe2c0
SHA1

15924241b4db41f623ac7c07b09dc8012650b7a6
SHA256

cb9338a525e9caa0c8d536626b6838a26211d9c6bfa8588a32335a5039e08ddc
SHA512

e93220e76d0e481c42852b4012bbd28c1c2438bfa0f3b66e522f0343bd499c0f04b21cc63fca17dcc9a6d69d2d872453c1d9afcceda3ab981f75adebddd709e9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e074d63a480d7bf671b3eb9f373fe2c0

Files

e074d63a480d7bf671b3eb9f373fe2c0
.dll windows:4 windows x86 arch:x86

5d67ca2286452ee6c1a6d95cd09ea0b2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcessHeap
Sleep
GetLastError
lstrcmpiW
CreateMutexA
CloseHandle
CreateThread
HeapFree
lstrcpynW
GetProcAddress
VirtualAlloc
GetModuleHandleA
VirtualProtect
WriteProcessMemory
GetCurrentProcess
HeapAlloc
ReadProcessMemory

user32

SetWindowsHookExA
CallNextHookEx

advapi32

LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ