20d5fdcbe689cc3e5c79a21b5d6422e3fb99cbe6d7ea19470b3e60fcc0542bfc | Triage

Sharing

Copy URL Twitter E-mail

General

Target

20d5fdcbe689cc3e5c79a21b5d6422e3fb99cbe6d7ea19470b3e60fcc0542bfc
Size

2.3MB
MD5

cac9b12bdf8a7dd01817054f282bab1d
SHA1

623be41dae105a150075eb2b3a8d5deb764847a0
SHA256

20d5fdcbe689cc3e5c79a21b5d6422e3fb99cbe6d7ea19470b3e60fcc0542bfc
SHA512

cb71039d3e1ef94cf45b5f998f062119f8b4fd90cfa422fde0e9cfede86ffa47a7659bc1d63b4db42593546493fbd0f7a419f0102e90375417b55543459d5c4e
SSDEEP

49152:7dOUVUvqbmP3tOrGP8OhwwbYNiEZ+REIjRqkTufOw4mYCZzLb9SBUYfx1l:JOgUvq43t3h0oEZ+uIwNWzgN/yNfXl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
20d5fdcbe689cc3e5c79a21b5d6422e3fb99cbe6d7ea19470b3e60fcc0542bfc

Files

20d5fdcbe689cc3e5c79a21b5d6422e3fb99cbe6d7ea19470b3e60fcc0542bfc
.dll windows:5 windows x86 arch:x86

1b49661b12027ad250fd1bb9855c1733

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

RemoveUsersFromEncryptedFile
CheckTokenMembership

kernel32

GetModuleHandleW
GetUserDefaultLangID
OutputDebugStringA
LoadLibraryExA

user32

ReleaseCapture
MessageBoxW
TrackPopupMenu

oleaut32

GetRecordInfoFromGuids
SafeArrayCreateVector

mprapi

MprInfoBlockAdd

gdi32

AbortDoc

Exports

Exports

VzhhoaeEnwsasio

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.crt
Size: 4KB - Virtual size: 151B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_MEM_READ

.data
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ