4bee5926a2e4bf2225d81bb6a5fde026daa83ccad920d8daa888eaf2f2a7bda8 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4bee5926a2e4bf2225d81bb6a5fde026daa83ccad920d8daa888eaf2f2a7bda8
Size

2.0MB
MD5

4269880635d12542b27172944d32b0bc
SHA1

b7dd4055c9a2512e3842ba0d5bb9baeb5042ea86
SHA256

4bee5926a2e4bf2225d81bb6a5fde026daa83ccad920d8daa888eaf2f2a7bda8
SHA512

780a3a3f3814515a56c42008af3547bca18fd1cd0be493bf5de5de5ca04f8cccef3bf8d88fa74231b3a5d6787558ad15ca10ba33af48cc17d5e6dc2455d33bdd
SSDEEP

49152:XkVUF70I41mtXvWAWmVKinQbadVlyYWz37t8F+k:XoUFoCXvrWmVKinaAlyYS8r

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4bee5926a2e4bf2225d81bb6a5fde026daa83ccad920d8daa888eaf2f2a7bda8

Files

4bee5926a2e4bf2225d81bb6a5fde026daa83ccad920d8daa888eaf2f2a7bda8
.dll windows:5 windows x86 arch:x86

2c51cc92dbbe2e9cc15a9536287773d1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleW
GetUserDefaultLangID
LoadLibraryExA
OutputDebugStringA

gdi32

AbortDoc

user32

TrackPopupMenu
GetWindowInfo
ReleaseCapture

advapi32

RemoveUsersFromEncryptedFile
DuplicateToken

mprapi

MprAdminConnectionEnum

oleaut32

GetRecordInfoFromGuids
SafeArrayCreateVector

Exports

Exports

VzhhoaeEnwsasio

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.crt
Size: 4KB - Virtual size: 114B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_MEM_READ

.data
Size: 184KB - Virtual size: 185KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 56KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ