478a66918c0c0eb347e87a43d7844ed0N | Triage

Sharing

General

Target

478a66918c0c0eb347e87a43d7844ed0N
Size

236KB
MD5

478a66918c0c0eb347e87a43d7844ed0
SHA1

554e568e67ec42ad5451f5e8f9336a744d3f0cd4
SHA256

d5f0e38ec25b196edbeb3777672aa1fcbd3551cf3400c2ca3118c53c09da0d92
SHA512

f85b28d8c273fe80422a0e6a6200e188009503d25995cc1b57e9c8495564d37000204c15a31639052f7e5fce87391a8ec377e92e2c12ff377125f88e3a2bd805
SSDEEP

6144:o1G3WVIOY6Bdjehj+qudd96ou/6mv5wdC:o1GmSafShjYdd96z/6cwdC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
478a66918c0c0eb347e87a43d7844ed0N

Files

478a66918c0c0eb347e87a43d7844ed0N
.dll windows:5 windows x86 arch:x86

ed2860c18f5483e3b5388bad75169dc1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

RegSaveKeyExA
AccessCheckAndAuditAlarmA

kernel32

SetWaitableTimer
GetModuleHandleA
LCIDToLocaleName
GetModuleHandleW
LoadLibraryExW
OutputDebugStringA
LoadLibraryExA
LoadLibraryA

winspool.drv

FindClosePrinterChangeNotification

setupapi

SetupDiInstallClassW

msvcrt

isspace

user32

GetFocus
ScrollWindow
CloseWindow

ole32

HMENU_UserFree

shlwapi

PathIsUNCW

Sections

.text
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.datA
Size: 124KB - Virtual size: 130KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 80KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 440B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ