1ee5e3890fa7292dba709500846e32315538864e84f72f958e49215780b98415 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1ee5e3890fa7292dba709500846e32315538864e84f72f958e49215780b98415
Size

2.0MB
MD5

2fef00af6d345e3f9b745e932a3ff075
SHA1

44c9f37dfda0bc0113c38fcac3f0576d52ea255b
SHA256

1ee5e3890fa7292dba709500846e32315538864e84f72f958e49215780b98415
SHA512

58a62939e4ed93b5cf8d61e94d02cea7baff5bc631d8d3bc9f35959da31a0e892d104a343dd67f5ad9eefb1c0029b5e77d8331b052aec907a43f9d281771697b
SSDEEP

49152:CGMKJA7HcgUO+zbi5nLbIkx7YPDWSRMeVAeNL8/zr2v4VRU/GpIg4:CGMKIWXiNLkkyWSRDAuazrzROg4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1ee5e3890fa7292dba709500846e32315538864e84f72f958e49215780b98415

Files

1ee5e3890fa7292dba709500846e32315538864e84f72f958e49215780b98415
.exe windows x86

a98f7a0e13d47e1a82f9a8ded223eef3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

oleaut32

SysFreeString

advapi32

RegQueryValueExA

user32

GetKeyboardType

gdi32

WidenPath

version

VerQueryValueA

ole32

CreateILockBytesOnHGlobal

comctl32

_TrackMouseEvent

urlmon

URLDownloadToFileA

wininet

InternetGetConnectedState

shell32

ShellExecuteA

winspool.drv

OpenPrinterA

comdlg32

ChooseColorA

wsock32

WSACleanup

msvcrt

_gcvt

libeay32

PEM_read_bio_PrivateKey

netapi32

Netbios

winmm

sndPlaySoundA

syunew3d

YWriteString

mwrf32

rf_beep

Sections

.text
Size: 2.0MB - Virtual size: 8.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE