d6761a3e7f960929d91aebed03d966ac640db176033260ff5606838a7a086155 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d6761a3e7f960929d91aebed03d966ac640db176033260ff5606838a7a086155
Size

2.6MB
MD5

1a1b2a22fa6deae04a2b9fb20d9cea7a
SHA1

0967edc8862e9c66ba2704d7691166e4c4c56734
SHA256

d6761a3e7f960929d91aebed03d966ac640db176033260ff5606838a7a086155
SHA512

34bc74bc9de3ddb66f713ad6a1efd92ad96a985aed82ce732233898e9c026b7c8bbf8656458d00751bb0b36fa8a04a66d22a2bc7c2b778a7bb2ba626a38a7d3d
SSDEEP

49152:J8EiMs64txPmQUxuStg/a4rOzDLctAWSl89LCYOUPInVSewI:MlmQKu5/JrQrQ9+YxAnVBw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d6761a3e7f960929d91aebed03d966ac640db176033260ff5606838a7a086155

Files

d6761a3e7f960929d91aebed03d966ac640db176033260ff5606838a7a086155
.dll windows:5 windows x86 arch:x86

440a9878011c7fb8ab1619d666cb44fa

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

gdi32

AbortDoc

ole32

CLSIDFromString

user32

TrackPopupMenu
CloseWindow
ReleaseCapture
ShowWindow

advapi32

RemoveUsersFromEncryptedFile
AccessCheck

kernel32

OutputDebugStringA
GetModuleHandleW
LoadLibraryExA
GetUserDefaultLangID

oleaut32

SafeArrayCreateVector

Exports

Exports

VzhhoaeEnwsasio

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.crt
Size: 4KB - Virtual size: 130B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_MEM_READ

.data
Size: 128KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ