ca393dc0c3e500e12f61418618c38cbc1f815dfc6760553b6400e7cd1522d78c | Triage

Sharing

General

Target

ca393dc0c3e500e12f61418618c38cbc1f815dfc6760553b6400e7cd1522d78c
Size

1.8MB
MD5

6bade87a07c2bbe3cc70c0aaa836b22c
SHA1

d87fd62d2b7a7e0f33a9009727c80d17a1501571
SHA256

ca393dc0c3e500e12f61418618c38cbc1f815dfc6760553b6400e7cd1522d78c
SHA512

b60246469b3cf988ab0f8b9ffc635b7c5bdfb20f9bba5b7ba5074a47b8d0aa07b92fe63be1bb09b544697855905aa238209118d999339045d4cde492c5cad6e7
SSDEEP

1536:0BOA0qKzBmromPgBqLxBqy5ZehAcITbk1fPeWnOCl/JPL48XpHv:0cFqKzBrtwq+ZPTbgmWnBJ4oVv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ca393dc0c3e500e12f61418618c38cbc1f815dfc6760553b6400e7cd1522d78c

Files

ca393dc0c3e500e12f61418618c38cbc1f815dfc6760553b6400e7cd1522d78c
.dll windows:6 windows x86 arch:x86

9cd66df553e97137737f52df6fc68e39

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateFileA
InitializeCriticalSection
WaitForMultipleObjects
WideCharToMultiByte
EnterCriticalSection
WaitForSingleObject
DeleteCriticalSection
GetLastError
LeaveCriticalSection
LoadLibraryA
GetProcAddress

user32

SetTimer
PostThreadMessageW
GetWindowThreadProcessId
CreateWindowExW
PostMessageW

Exports

Exports

HorekGlepW

Sections

.text
Size: 146KB - Virtual size: 146KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 692B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 228B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tdata
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ