e0e921d34cf689c0981b6426349b34d6 | Triage

Sharing

General

Target

e0e921d34cf689c0981b6426349b34d6
Size

7KB
MD5

e0e921d34cf689c0981b6426349b34d6
SHA1

22040db960b67b3313eb7af6ad35066ab1aff040
SHA256

735562fb1c0bdd1542dce763cc58e8e3263c8d2b4e0513916bbc398c7a3c7929
SHA512

c07d68df86519be6ba47422d1d626be2b2dedee210c792b95a05f51fbfb753cbdeb8f13d379817237c0cee43fcefc8858efe71c4a1a5e925d49ed84d55e8e553
SSDEEP

96:Hvghf51KofqaqhHuiEFTjZW4ArtsGOLEafhdMba:PKf51KTOF5MbrteLLHMb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e0e921d34cf689c0981b6426349b34d6

Files

e0e921d34cf689c0981b6426349b34d6
.dll windows:4 windows x86 arch:x86

af1186ead1cc5a71f7bc4452086ae8f2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

Sleep
VirtualProtectEx
GlobalFree
IsBadReadPtr
GlobalLock
GlobalAlloc
GetCurrentProcess
CreateThread
GetModuleFileNameA
ReadProcessMemory

user32

EnumChildWindows
GetClassNameA
IsWindowVisible
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
SendMessageA
FindWindowA
FindWindowExA

wininet

InternetCloseHandle
InternetOpenUrlA
InternetOpenA
InternetReadFile

msvcrt

strrchr
_adjust_fdiv
malloc
_initterm
free
memcpy
??3@YAXPAX@Z
strcmp
strlen
??2@YAPAXI@Z
sprintf
strcpy
_stricmp

Exports

Exports

fa
fc

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 508B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sdt
Size: 512B - Virtual size: 271B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 474B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ