502e0a4a95cb0e36a3c9b33d28c7f1da49f1aeb6bda89b4b110701a8902b1d9f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

502e0a4a95cb0e36a3c9b33d28c7f1da49f1aeb6bda89b4b110701a8902b1d9f
Size

37KB
MD5

8a92cfd529b7c2a53c9e7760a64cd857
SHA1

09dfe280aae050561d5d41b16f2fda44b7d6d964
SHA256

502e0a4a95cb0e36a3c9b33d28c7f1da49f1aeb6bda89b4b110701a8902b1d9f
SHA512

447856512558f56bddda4518702f0cf0eda98018c4ab09e06c4348e46dfd78373d15f6fccc239d22a7cccade9a9255487405a09f9c493a3cc93da1a1b5ceae12
SSDEEP

768:OYKZcbMCwLt3v/MiKRG59RXsB9xbOEjQSIOJT:XKeQCwLO/eiRV5T

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
502e0a4a95cb0e36a3c9b33d28c7f1da49f1aeb6bda89b4b110701a8902b1d9f

Files

502e0a4a95cb0e36a3c9b33d28c7f1da49f1aeb6bda89b4b110701a8902b1d9f
.exe windows x86

c77ea547846f55cdd172404e96c0044c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

UnhookWindowsHookEx
SetWindowsHookExA
wsprintfA

kernel32

HeapAlloc
GetProcessHeap
LoadLibraryA
GetProcAddress
HeapFree
GetVersion
ExitProcess
GetTickCount
lstrcpyA
IsWow64Process
GetCurrentProcess
lstrcmpiA
GetSystemTimeAsFileTime
GetTempPathW
GetTempFileNameW
CreateFileW
WriteFile
CloseHandle
DeleteFileW
GetVolumeInformationA
GetTempPathA
GetModuleFileNameA
CreateFileA
GetModuleFileNameW
Sleep
CreateToolhelp32Snapshot
Thread32Next
CreateEventW
BeginUpdateResourceW
UpdateResourceA
EndUpdateResourceA
LoadLibraryW
WaitForSingleObject
GetLastError
lstrcmpA

shell32

ShellExecuteW

Sections

.text
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ