22b6aa8c118f850e14eb78efadd00ee0N | Triage

Sharing

General

Target

22b6aa8c118f850e14eb78efadd00ee0N
Size

236KB
MD5

22b6aa8c118f850e14eb78efadd00ee0
SHA1

04ce345c2c15f458f5e9c0a86f72e5639c40e5ac
SHA256

a6ea57cdb7ea0f0d7d073f2fe4ef53456734b97eaa0e35b8c5a0225e0aa582d0
SHA512

e84d891b4e7c5bfc0edf9a774c1e035816e8649a18bf90c33fc7676d557ec49b622a2ffcc82b4f6b388ea91f2d61af168781f097fcc826296db38fa6b58acf49
SSDEEP

6144:51G3WVIOY6Bdjehj+qudd96oud6mv5wdC:51GmSafShjYdd96zd6cwdC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

22b6aa8c118f850e14eb78efadd00ee0N

Files

22b6aa8c118f850e14eb78efadd00ee0N
.dll windows:5 windows x86 arch:x86

ed2860c18f5483e3b5388bad75169dc1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

RegSaveKeyExA
AccessCheckAndAuditAlarmA

kernel32

SetWaitableTimer
GetModuleHandleA
LCIDToLocaleName
GetModuleHandleW
LoadLibraryExW
OutputDebugStringA
LoadLibraryExA
LoadLibraryA

winspool.drv

FindClosePrinterChangeNotification

setupapi

SetupDiInstallClassW

msvcrt

isspace

user32

GetFocus
ScrollWindow
CloseWindow

ole32

HMENU_UserFree

shlwapi

PathIsUNCW

Sections

.text
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.datA
Size: 124KB - Virtual size: 130KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 80KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 440B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ