54b474c8e797328bc7dbe629675614c25c8cb3dbaeb20ad90b29deb48056223b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

54b474c8e797328bc7dbe629675614c25c8cb3dbaeb20ad90b29deb48056223b
Size

2.5MB
MD5

8cca12a6c7b27392c7fae23fdb575690
SHA1

36367e66fe154fde25495c41384fc038755ee59f
SHA256

54b474c8e797328bc7dbe629675614c25c8cb3dbaeb20ad90b29deb48056223b
SHA512

c5c1307cdceef9ced8a3378ad6d5ffe0ed0cfc6d314226faa1b61428859bd48d6139bc5616d0b7eb9dbcf73359d95ab2a5fd6164d397d5676c4a25590688dc88
SSDEEP

49152:fQL1yFJS0JGitT+h2+dEbR/L+YTM7uSeJ9m/gEYySiJGDy2L8s5nn:4LkF1TT+h2vLvTM7uSenSCLBJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
54b474c8e797328bc7dbe629675614c25c8cb3dbaeb20ad90b29deb48056223b

Files

54b474c8e797328bc7dbe629675614c25c8cb3dbaeb20ad90b29deb48056223b
.exe windows x86

cfca565c5f007c1ca324b7fd1d358d87

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

mpr

WNetGetConnectionA

version

VerQueryValueA

gdi32

UnrealizeObject

ole32

IsEqualGUID

comctl32

ImageList_SetIconSize

winspool.drv

OpenPrinterA

shell32

Shell_NotifyIconA

wininet

InternetReadFile

comdlg32

PageSetupDlgA

wsock32

send

pquery.bin

WyQueryPYWhole

msvcrt

_gcvt

idcardreader\termb

Read_Content

idcardreader\dll_file

unpack

lz32

LZOpenFileA

Sections

CODE
Size: 2.5MB - Virtual size: 10.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 56KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE