d15be1405015c3e4c7418bf7462d536c0f8a8795fee843a3a24721b1a4d3cf9b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d15be1405015c3e4c7418bf7462d536c0f8a8795fee843a3a24721b1a4d3cf9b
Size

2.9MB
MD5

77b0aac78fbe3ae3b95c7fa3f81454cd
SHA1

a94d9bd39b789e89d9c9f28b268a6093a54906f1
SHA256

d15be1405015c3e4c7418bf7462d536c0f8a8795fee843a3a24721b1a4d3cf9b
SHA512

a8b065ec585ed0f96c0ff99f10180278f65199cf86d54b44e44a7acd09a855a38d7b925a6eb55fbd26e32e396765ddb48dbc52c9442b85ec5b19405a4479a694
SSDEEP

49152:9uUbz4eTyWzfoXc09vanXOFV2yHeW26Df4BAW69aiHvZ5:9Fbz4eTpcFcXikyY6DTpB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d15be1405015c3e4c7418bf7462d536c0f8a8795fee843a3a24721b1a4d3cf9b

Files

d15be1405015c3e4c7418bf7462d536c0f8a8795fee843a3a24721b1a4d3cf9b
.dll windows:5 windows x86 arch:x86

528e77b22f6553714e431f02fc6a8567

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

RemoveUsersFromEncryptedFile
RegSaveKeyA

oleaut32

SafeArrayCreateVector
GetRecordInfoFromGuids

mprapi

MprAdminInterfaceTransportGetInfo

user32

ReleaseCapture
GetInputState
TrackPopupMenu

gdi32

AbortDoc

kernel32

GetStringTypeA
GetModuleHandleW
LoadLibraryExA
OutputDebugStringA

Exports

Exports

VzhhoaeEnwsasio

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.crt
Size: 4KB - Virtual size: 167B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_MEM_READ

.data
Size: 272KB - Virtual size: 274KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 84KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ