8f4d580ff4105b91d85a4a5afec16fe2681993b909dc3947a6d2bfeb196e28fb | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8f4d580ff4105b91d85a4a5afec16fe2681993b909dc3947a6d2bfeb196e28fb
Size

2.5MB
MD5

bf824547589c0b338ddf09b66a74b72e
SHA1

528909765f336bf34b636a014d9e1f2eed4af23c
SHA256

8f4d580ff4105b91d85a4a5afec16fe2681993b909dc3947a6d2bfeb196e28fb
SHA512

da91820c756f446fda64f290547f4fb5f61f29a1a98570886a5c5f5c47e0c73bf5bb1448b6558720c99d15714369f24d5127028b943929d3a182dbf0a8e5d110
SSDEEP

49152:nV0H79GQt+D1FvDCl0tYlb/Z0fjAGgfdmKDLd9yLM8axkfOiWMlBzVkoVU5P+g:VlEE1F7ClzJqjYxeaib77VkoVU5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8f4d580ff4105b91d85a4a5afec16fe2681993b909dc3947a6d2bfeb196e28fb

Files

8f4d580ff4105b91d85a4a5afec16fe2681993b909dc3947a6d2bfeb196e28fb
.exe windows x86

175369224eb3be6fb350fddfaa3ff3fa

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

mpr

WNetGetConnectionA

version

VerQueryValueA

gdi32

UnrealizeObject

ole32

IsEqualGUID

comctl32

ImageList_SetIconSize

winspool.drv

OpenPrinterA

shell32

Shell_NotifyIconA

wininet

InternetReadFile

comdlg32

PageSetupDlgA

wsock32

send

pquery.bin

WyQueryPYWhole

msvcrt

_gcvt

lz32

LZOpenFileA

Sections

CODE
Size: 2.5MB - Virtual size: 10.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 56KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE