DridexDroppedVBS[.]925da3a10f7dde802c8d87047b14fda6

Sharing

Copy URL

Twitter E-mail

General

Target

DridexDroppedVBS.925da3a10f7dde802c8d87047b14fda6
Size

140KB
MD5

925da3a10f7dde802c8d87047b14fda6
SHA1

1fc59fbf692f690b9fe82cfafc9dcbd5aac31a68
SHA256

c94fe7b646b681ac85756b4ce7f85f4745a7b505f1a2215ba8b58375238bad10
SHA512

82588188de13f34cd751da7409f780c4fc5814da780fe8cad1fa73370414fb24b9822fc56f1f162d0db4a5c27159c225bc4d4fb061a87cb3c0d89b067353a478
SSDEEP

3072:X9z9zjy6WEba5uuoLPhiVF3NT5nNpytoQE:X9J9gu0td5nN4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
DridexDroppedVBS.925da3a10f7dde802c8d87047b14fda6

Files

DridexDroppedVBS.925da3a10f7dde802c8d87047b14fda6
.exe windows:5 windows x86 arch:x86

b10a33e794d5d2de180070d9dcc93422

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

vfW|ZyZ9v345234bn5234nb

Imports

advapi32

GetUserNameA
OpenBackupEventLogA
CreatePrivateObjectSecurityEx

winmm

midiInGetDevCapsA

kernel32

EnumResourceNamesA
GetBinaryTypeA
GetCurrentProcess
GetNumaHighestNodeNumber
IsValidLocale
GetModuleFileNameW
HeapQueryInformation
FindNextChangeNotification
CreateSemaphoreW

user32

GetAsyncKeyState
IsCharAlphaA
CharNextA
GetSysColor
EnumClipboardFormats
IsCharAlphaW
GetActiveWindow
GrayStringW
CascadeWindows
LookupIconIdFromDirectory
GetProcessDefaultLayout

wininet

ReadUrlCacheEntryStream

gdi32

CreateDiscardableBitmap

wintrust

CryptCATAdminReleaseCatalogContext
CryptCATCDFClose

powrprof

IsPwrSuspendAllowed

mscms

WcsSetUsePerUserProfiles

urlmon

HlinkSimpleNavigateToString

shlwapi

AssocQueryKeyW

iphlpapi

GetBestRoute
GetNumberOfInterfaces

Sections

.text
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.coda
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b10a33e794d5d2de180070d9dcc93422

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

winmm

kernel32

user32

wininet

gdi32

wintrust

powrprof

mscms

urlmon

shlwapi

iphlpapi

Sections

.text Size: 8KB - Virtual size: 4KB

.coda Size: 12KB - Virtual size: 10KB

.rdata Size: 108KB - Virtual size: 107KB

.data Size: 4KB - Virtual size: 7KB

.reloc Size: 4KB - Virtual size: 348B

.text
Size: 8KB - Virtual size: 4KB

.coda
Size: 12KB - Virtual size: 10KB

.rdata
Size: 108KB - Virtual size: 107KB

.data
Size: 4KB - Virtual size: 7KB

.reloc
Size: 4KB - Virtual size: 348B