78de41633c563cfbd6cafcdf308c0350N | Triage

Sharing

General

Target

78de41633c563cfbd6cafcdf308c0350N
Size

236KB
MD5

78de41633c563cfbd6cafcdf308c0350
SHA1

9332c003b2508611cfafbfc55704ea82895395a7
SHA256

8d34c75f8d69675eb0bb94b920f4688a0e3b2c40006378e8f0c375f89ed4f298
SHA512

5a2151265b93ca9aa133762134cdc256f59a6fd0f193dcc318088dd9282802a19c559ceed970c075534ab67c561ec1bd183efe0b4c827c4a6ad6c19902bbaeeb
SSDEEP

6144:84V3yyQTz8ITeRDZSw3D2Fsd1u/6mv5/dC:8ciyQTdT+swTgt/6c/dC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
78de41633c563cfbd6cafcdf308c0350N

Files

78de41633c563cfbd6cafcdf308c0350N
.dll windows:5 windows x86 arch:x86

7df9dbed14147558d9c2b16fc9eecc49

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ole32

HMENU_UserFree

winspool.drv

FindClosePrinterChangeNotification

kernel32

LoadLibraryExA
LCIDToLocaleName
SetWaitableTimer
GetModuleHandleA
GetModuleHandleW
LoadLibraryExW
OutputDebugStringA
LoadLibraryA

shlwapi

PathIsUNCA

advapi32

RegSaveKeyExA
AccessCheckAndAuditAlarmW

user32

GetFocus
ScrollWindow
CloseWindow

setupapi

SetupDiInstallClassA

msvcrt

isspace

Sections

.text
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.datA
Size: 124KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 80KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 236B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ