d5393505b050eadda456a722c489398d0b8040573d0d668071358c55c5ee8113 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d5393505b050eadda456a722c489398d0b8040573d0d668071358c55c5ee8113
Size

3.0MB
MD5

09259796231c6accac59f04eaf6f36f4
SHA1

ad67ac2c96c39d5d7a3de0b2b800caec959c6c1b
SHA256

d5393505b050eadda456a722c489398d0b8040573d0d668071358c55c5ee8113
SHA512

f8bc18990c8f486364e1df54075e0e46ab32623d90dac56710c85934893bc9591af56949535691e58b2f9d3de93271796ca9bbdab0fe428faad8debce94620f3
SSDEEP

49152:rORq+5++4/hdynN89+T3ysT6FokkAIYgIoIO3N/y0YQUQfahQ6ewgh+4rR8A272G:rOfTlazf7YjkjyO6/xo1NmFQd9VytKlS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d5393505b050eadda456a722c489398d0b8040573d0d668071358c55c5ee8113

Files

d5393505b050eadda456a722c489398d0b8040573d0d668071358c55c5ee8113
.dll windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

WinXYSDK.ni.pdb
E:\Workspace\windows_sdk_v3.3.1\XYClientWin\Production\WinXYSDK.pdb

Sections

.data
Size: 468KB - Virtual size: 467KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 123KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ