e1c8c8af2ee5ed0d5c8709f6755b7434 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e1c8c8af2ee5ed0d5c8709f6755b7434
Size

32KB
MD5

e1c8c8af2ee5ed0d5c8709f6755b7434
SHA1

045e5121e0858f6162937c63e408f6b0585f9a16
SHA256

bacc3c9224ae555076370090d3b13fcbf41322b1ccb3c98b94f8f1dc2ac18344
SHA512

12fd4233c8841c327d8493a97126f47a28d0f36c2fd77b1c6368295f6d9b229d129e764a4a8fc0a03f3c0b64a9fbfdde8e5cc98f80e7c50c8d02b3430b42a561
SSDEEP

384:GbzuIwI71v6kgZXacbuvsSTCXLJpsKmwO5T:GbzlwiWZX52sS4fsKmwiT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e1c8c8af2ee5ed0d5c8709f6755b7434

Files

e1c8c8af2ee5ed0d5c8709f6755b7434
.dll windows:4 windows x86 arch:x86

29a80bb67c34da6b2cedcf4d3a78ce5f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetCurrentProcess
VirtualProtect
FlushInstructionCache
GetProcAddress
GetModuleFileNameA
VirtualProtectEx
GlobalFree
ReadProcessMemory
GlobalAlloc
Sleep
ExitThread
CreateThread
SetLastError

user32

SetWindowsHookExA
CallNextHookEx

wininet

InternetCloseHandle
InternetOpenUrlA
InternetOpenA
InternetReadFile

advapi32

RegCreateKeyA
RegSetValueExA

ws2_32

closesocket

msvcrt

_adjust_fdiv
malloc
_initterm
free
_stricmp
strncpy
_snprintf
_strnicmp
strrchr
strstr
memcpy
strlen
??3@YAXPAX@Z
??2@YAPAXI@Z
__CxxFrameHandler
_EH_prolog
memset
strcat
strcpy

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gdat
Size: 4KB - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ