e86f1835855cf44b65709ffc766c25e0N | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e86f1835855cf44b65709ffc766c25e0N
Size

1.7MB
MD5

e86f1835855cf44b65709ffc766c25e0
SHA1

df954b1ddc37195ef411647f14a95c89038a18f5
SHA256

27e24891c1b5d5b4a028ba8b3c1f4297d09ac8d750697718cab9ee5956ff5b85
SHA512

90736a0563be1a8f0bc5eb6dd6f2e45e1e39bb211b099852dbcc96367afaf5cca8359542e762a2242a3fef9769ade4566cf9e9e769837a90fb13b615279cfa3e
SSDEEP

49152:GQYUhoImRoI5rQYCpywc1Pl/RJtIQ0IhF2ZKwfKsLyWxOFTlfypI/1KuEQI/1Kuj:GQYUhoImRoI5rQYCpywc1Pl/RJtIQ0Ii

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e86f1835855cf44b65709ffc766c25e0N

Files

e86f1835855cf44b65709ffc766c25e0N
.dll windows:5 windows x86 arch:x86

714378fc53c1851a58b35d00577e038a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

VirtualProtect
lstrlenA
GetModuleFileNameA
SetFileAttributesA
CreateFileA
WriteFile
CloseHandle
DeleteFileA

user32

MessageBoxA

ntdll

memcpy

Exports

Exports

DllMain
Ninja

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 432B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 84B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 584B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ