ce680c4bc5dbbc7653c460f304a2cc60N | Triage

Sharing

General

Target

ce680c4bc5dbbc7653c460f304a2cc60N
Size

236KB
MD5

ce680c4bc5dbbc7653c460f304a2cc60
SHA1

3ef88db9bab60462a6a2c2e1ad6c2eeca4e75351
SHA256

ed24eece39db455a581606a6b6ebae2bdc90bdbec3aed974f619a3a0cd9d1431
SHA512

ea04cb2cca9059195601293d6677a60f3e7f48edfc22e3f456ca4f7ae759b802b23cec570e8071fa92092c3f8162e8709c0a6f62de5d5e0527c6f32a2bc1ea49
SSDEEP

6144:P4V3yyQTz8ITeRDZSw3D2Fsd1u/6mv5/dC:PciyQTdT+swTgt/6c/dC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

ce680c4bc5dbbc7653c460f304a2cc60N

Files

ce680c4bc5dbbc7653c460f304a2cc60N
.dll windows:5 windows x86 arch:x86

7df9dbed14147558d9c2b16fc9eecc49

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ole32

HMENU_UserFree

winspool.drv

FindClosePrinterChangeNotification

kernel32

LoadLibraryExA
LCIDToLocaleName
SetWaitableTimer
GetModuleHandleA
GetModuleHandleW
LoadLibraryExW
OutputDebugStringA
LoadLibraryA

shlwapi

PathIsUNCA

advapi32

RegSaveKeyExA
AccessCheckAndAuditAlarmW

user32

GetFocus
ScrollWindow
CloseWindow

setupapi

SetupDiInstallClassA

msvcrt

isspace

Sections

.text
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.datA
Size: 124KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 236B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ