3463f026ce1c325931e285b587b82f7f690db2e75929c7edd154df1e14f38c93 | Triage

Sharing

General

Target

3463f026ce1c325931e285b587b82f7f690db2e75929c7edd154df1e14f38c93
Size

3.7MB
MD5

4820f3c0c2b85d9e8ebb121fd35cb3bc
SHA1

e645cb78d7e100c4a3f13eb5f88e09cd31377b26
SHA256

3463f026ce1c325931e285b587b82f7f690db2e75929c7edd154df1e14f38c93
SHA512

35f8b12982b229be8a96aa867050c0ecb1807e58cbf6acef0d214cf049f933e8e240a4d1022429d6a99a0315b4af47af37c01b1decb28a7b5fe621354673d7f2
SSDEEP

49152:VwJ6bUFSuLjWTrbfQlrd088iG1oO9BDA80xZ8MT+:VwCPc088iG1oO9BDA80xZ8MT+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
3463f026ce1c325931e285b587b82f7f690db2e75929c7edd154df1e14f38c93

Files

3463f026ce1c325931e285b587b82f7f690db2e75929c7edd154df1e14f38c93
.dll windows:6 windows x64 arch:x64

a5d156f0c03955fd5c90a10345646746

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GetCommandLineA
CreateFileA
FindFirstFileA
FindNextFileA
GetFileAttributesA
GetFileInformationByHandle
WriteFile
CloseHandle
HeapAlloc
HeapFree
GetProcessHeap
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
GetCurrentThreadId
GetModuleFileNameA
GetModuleHandleExA
GetProcAddress
SwitchToFiber
DeleteFiber
CreateFiber
LoadLibraryA

Exports

Exports

rBgTBiTTDW

Sections

.text
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 264B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ