0c64cc96a52ff9bdf6593e948fed1bc743bdf714ec1f7b392490423d927c3bb4 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0c64cc96a52ff9bdf6593e948fed1bc743bdf714ec1f7b392490423d927c3bb4
Size

8KB
MD5

0830581452de0c91090f8de7dbd123fb
SHA1

bb1c27db5f8d7e43592fa81cbfa319f1ce7c828f
SHA256

0c64cc96a52ff9bdf6593e948fed1bc743bdf714ec1f7b392490423d927c3bb4
SHA512

27a4cf43f4c9ce1bb0060a25e4a29c4fbbb69597e3606f51cc080706110afcdc236df4c902966367b7f45231dbec6a3c4eda533508d2585b06bbd2623411ab0e
SSDEEP

192:BivhbDxmw/DiKhXVlc2HWV5yTX785sqKaT4W:BihFmw/9hgETraT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0c64cc96a52ff9bdf6593e948fed1bc743bdf714ec1f7b392490423d927c3bb4

Files

0c64cc96a52ff9bdf6593e948fed1bc743bdf714ec1f7b392490423d927c3bb4
.dll windows:6 windows x86 arch:x86

6a42b7783056a8e84f8a23d7380b1bfa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpA
CreateFileMappingA
OpenFileMappingA
LoadLibraryA
GetProcAddress
GlobalFree
GetSystemDirectoryA
lstrlenA
GetModuleHandleA
UnmapViewOfFile
MapViewOfFileEx
CloseHandle
CopyFileA
lstrcatA
lstrcpyA
ExitProcess
GlobalAlloc
GetEnvironmentVariableA

advapi32

OpenServiceA
OpenSCManagerA
CreateServiceA
CloseServiceHandle
ChangeServiceConfig2A
RegSetValueExA
RegCreateKeyExA
RegCloseKey
StartServiceA

user32

wsprintfA

Exports

Exports

WTSQueryUserToken

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ