cff54c363c1d64d9b2ca473c6ec5d6e3dce4bfe538f116c1ac0f8d466a20aeae | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cff54c363c1d64d9b2ca473c6ec5d6e3dce4bfe538f116c1ac0f8d466a20aeae
Size

43KB
MD5

7ac4b1b70f03086620f2bdd5d5bf62ee
SHA1

672d32c74340bed9e665905419d57c55277a5ad1
SHA256

cff54c363c1d64d9b2ca473c6ec5d6e3dce4bfe538f116c1ac0f8d466a20aeae
SHA512

95d6f9f37e32cf5cfe0d07386b4bea18b742970c9c4ac21b7291e29f4ed8b1f228419ab35831e7003ba0adabc88ec6fc5aaa40aa67b4473181c71e82f919e8c7
SSDEEP

768:5Y65vSjtHTsEbqIYoHZtXl9H3WXSKVLhYIiBf2kiV9iTFRO6O0SJ0slg2Q:KKvShHTsK/JuVdYVBfKeO6dSvlg3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cff54c363c1d64d9b2ca473c6ec5d6e3dce4bfe538f116c1ac0f8d466a20aeae

Files

cff54c363c1d64d9b2ca473c6ec5d6e3dce4bfe538f116c1ac0f8d466a20aeae
.dll windows:4 windows x86 arch:x86

096d78266a405b7224a4733bd9fe54c7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

RtlWriteRegistryValue
ZwLoadDriver
RtlAdjustPrivilege
ZwOpenEvent
_stricmp
strrchr
RtlImageNtHeader
RtlCreateRegistryKey

kernel32

CreateFileA
MultiByteToWideChar
GetModuleFileNameA
LoadLibraryExA
GetModuleHandleA
VirtualProtect
FreeLibrary
SetEvent
CloseHandle
CreateThread
SetFilePointer
WriteFile

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 736B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 440B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ