0cfb8f27d20d3fef30fc4b14cde77e5c9406c80f24d9c068e39a5602712e155e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0cfb8f27d20d3fef30fc4b14cde77e5c9406c80f24d9c068e39a5602712e155e
Size

156KB
MD5

dbb2b310f39b4e20b7d00c0c6f516d8e
SHA1

bae9a547223a3546863b96976681c7878d96ccdb
SHA256

0cfb8f27d20d3fef30fc4b14cde77e5c9406c80f24d9c068e39a5602712e155e
SHA512

ce3cf3982bb95918c44e95ad338cfa49ac255b43408160314fe5f593344070bc0c9cdd9bd11b52c06acd5b4fa7dca0d19340ed5859d0d61254f3c2c2c797ca27
SSDEEP

3072:AgFiNXTpwuvOh5pZCgPjfDZcQPLl8FWpQDxFx7JNmSEtB1jf:AqiQaObpZCgLfKQPBVp2FxuScDj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0cfb8f27d20d3fef30fc4b14cde77e5c9406c80f24d9c068e39a5602712e155e

Files

0cfb8f27d20d3fef30fc4b14cde77e5c9406c80f24d9c068e39a5602712e155e
.dll windows:4 windows x86 arch:x86

8c04cfe34120a27b6430f224a4476034

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
DeviceIoControl
ExitProcess
FindResourceA
FormatMessageA
GetACP
GetCommandLineA
GetCurrentThread
GetCurrentThreadId
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetOEMCP
GetStartupInfoA
GetTimeZoneInformation
GlobalUnlock
HeapAlloc
HeapCreate
HeapReAlloc
LeaveCriticalSection
MultiByteToWideChar
RtlUnwind
SetLastError
SetProcessWorkingSetSize
SetUnhandledExceptionFilter
VirtualAlloc
lstrcpyA
lstrlenA

user32

InvalidateRect
GetUserObjectSecurity
DrawEdge
CreateDialogParamA
ClientToScreen

comdlg32

PageSetupDlgA
FindTextA

Exports

Exports

NSC_ModuleDBFunc

Sections

.text
Size: 96KB - Virtual size: 212KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 57KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ