da56a69dd8691102699228bdaff85fc35feb1738cfb7857d5429ae71e2d8f623 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

da56a69dd8691102699228bdaff85fc35feb1738cfb7857d5429ae71e2d8f623
Size

21KB
MD5

2c8bb040e2ffe463909e8550b2d3c6b2
SHA1

95fe64699cb9f7e4de4dd3d547a65d386a18a152
SHA256

da56a69dd8691102699228bdaff85fc35feb1738cfb7857d5429ae71e2d8f623
SHA512

1c80112ab53a4cbc7e64b815e2b7e4a9007c6a8980485293fb0c585bc6f726aa27d6172aaf032a77fdd86d468e928b2ab597d3ff21ee5a4c6de807c88ae571b1
SSDEEP

384:2912eop8vbvJykjl+YOGxE+9FinuOxA0BGy2iK/WoB4iB5:29goDl+Y7xZ8xxAMGy2t9tB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
da56a69dd8691102699228bdaff85fc35feb1738cfb7857d5429ae71e2d8f623

Files

da56a69dd8691102699228bdaff85fc35feb1738cfb7857d5429ae71e2d8f623
.dll windows:6 windows x86 arch:x86

452d19117ddea2739393fea7e8fe1edc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

RtlRandom
memset

kernel32

CloseHandle
GetSystemDirectoryW
CreateProcessW
GetTempPathW
GetTempFileNameW
HeapCreate
GetCommandLineW
LoadLibraryA
FreeLibrary
CreateDirectoryW
GetVersion
CreateEventW
SetEvent
Sleep
WriteFile
VirtualAlloc
VirtualFree
CreateFileW
OpenProcess
GetLastError
FindFirstFileW
FindNextFileW
FindClose
HeapAlloc
HeapFree
MultiByteToWideChar
WideCharToMultiByte
GetModuleFileNameW
GetCurrentProcess
GetProcAddress
GetModuleHandleA
GetTickCount
ResetEvent
GetCurrentProcessId

advapi32

StartServiceW
OpenServiceW
CloseServiceHandle
ChangeServiceConfig2W
CreateServiceW
OpenSCManagerW
ConvertStringSecurityDescriptorToSecurityDescriptorA

shell32

CommandLineToArgvW
ShellExecuteW

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 786B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ