trainer[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

trainer.exe
Size

283KB
MD5

f940382f1f9b359f08a2bec00a468d0f
SHA1

912fab02693440745e706f0d0c0d93c69b1e37e8
SHA256

18d682437464e3f63d765ac21e5be5cf5be0a9dce09430e086627d25627d1747
SHA512

27afbc01168f71adaba55f34c3f75e9b4414b83641e88c07b511c2a4dfb9d4f5e9b191dd848b00bc54d2e3541a90f4c80c9fc7ba1d97aad12ecb95cb4b60d0b2
SSDEEP

6144:5JkXLx5NcmOMey4imy6Dhw7gO0PPS7Yt0rqKHwq5Pvc:5JYLx5Nq5y6+7g5PSu0rqKHW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
trainer.exe

Files

trainer.exe
.exe windows x86

a604d65f28d5f3a0a6087c0b63c32d77

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

gdiplus

GdipFree

comctl32

InitCommonControlsEx

user32

GetDC

gdi32

BitBlt

advapi32

RegCloseKey

shell32

ShellExecuteW

ole32

CreateStreamOnHGlobal

winmm

PlaySoundW

Sections

.MPRESS1
Size: 137KB - Virtual size: 564KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 142KB - Virtual size: 141KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE