d98dbec4db90039d376753b9ae9eb549acc3bbd7793bbd91ee5676048e8faed4 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d98dbec4db90039d376753b9ae9eb549acc3bbd7793bbd91ee5676048e8faed4
Size

2.3MB
MD5

d02430508b6115dd3d49a8825ff15062
SHA1

376a6815aea993bfa5f558d01d5637ec667b3f97
SHA256

d98dbec4db90039d376753b9ae9eb549acc3bbd7793bbd91ee5676048e8faed4
SHA512

6413c46ee56a5440cd212a735c2ef3979105f4b969910b85d412dd1da7d72c70ae6ee9fa0fd55c7256f3bafdeb66680498d36bd54b49f8ad100253393f2fa6e2
SSDEEP

49152:qdOUVUvqbmP3tOrGP8OhwwbYNiEZ+REIjRqkTufOw4mYCZzLb9SBUYfx1h:2OgUvq43t3h0oEZ+uIwNWzgN/yNfXh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d98dbec4db90039d376753b9ae9eb549acc3bbd7793bbd91ee5676048e8faed4

Files

d98dbec4db90039d376753b9ae9eb549acc3bbd7793bbd91ee5676048e8faed4
.dll windows:5 windows x86 arch:x86

1b49661b12027ad250fd1bb9855c1733

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

RemoveUsersFromEncryptedFile
CheckTokenMembership

kernel32

GetModuleHandleW
GetUserDefaultLangID
OutputDebugStringA
LoadLibraryExA

user32

ReleaseCapture
MessageBoxW
TrackPopupMenu

oleaut32

GetRecordInfoFromGuids
SafeArrayCreateVector

mprapi

MprInfoBlockAdd

gdi32

AbortDoc

Exports

Exports

VzhhoaeEnwsasio

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.crt
Size: 4KB - Virtual size: 151B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_MEM_READ

.data
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ