d98a97a19e00e699b44f4d50e9724ed0N | Triage

Sharing

General

Target

d98a97a19e00e699b44f4d50e9724ed0N
Size

236KB
MD5

d98a97a19e00e699b44f4d50e9724ed0
SHA1

0255d955604787ff6da7ec34c498eee2c15ea587
SHA256

81228bad32d7767ac375af937eacf20fadf365779697fcaaf115401e5f0eb8b3
SHA512

2ef200a5e7cc5be247c7edf5a6b9a212b2d447e4af68ce1ec0e0b15285ffb147eb317c3fa26c5472ab47720727fd4860ce23af4bdc281141f635123b79d9a329
SSDEEP

6144:Q4V3yyQTz8ITeRDZSw3D2Fsd1u/6mv5/dC:QciyQTdT+swTgt/6c/dC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d98a97a19e00e699b44f4d50e9724ed0N

Files

d98a97a19e00e699b44f4d50e9724ed0N
.dll windows:5 windows x86 arch:x86

7df9dbed14147558d9c2b16fc9eecc49

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ole32

HMENU_UserFree

winspool.drv

FindClosePrinterChangeNotification

kernel32

LoadLibraryExA
LCIDToLocaleName
SetWaitableTimer
GetModuleHandleA
GetModuleHandleW
LoadLibraryExW
OutputDebugStringA
LoadLibraryA

shlwapi

PathIsUNCA

advapi32

RegSaveKeyExA
AccessCheckAndAuditAlarmW

user32

GetFocus
ScrollWindow
CloseWindow

setupapi

SetupDiInstallClassA

msvcrt

isspace

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.datA
Size: 124KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 236B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ