5cea1e8af6c2186067a84e91e6bed265fed0e3aa122b917a339af83adb551467 | Triage

Sharing

General

Target

5cea1e8af6c2186067a84e91e6bed265fed0e3aa122b917a339af83adb551467
Size

56KB
MD5

6cf332d0e20a09d05f9da43cc53b5332
SHA1

a81d0a2bb62ad6d9f1f57f2d12b73cddbf1cc543
SHA256

5cea1e8af6c2186067a84e91e6bed265fed0e3aa122b917a339af83adb551467
SHA512

62b6af4e54002be4279ac67c9e7f73f97a4afc0f2413a59962266348e67cbc9b7087efea941de80456a7e70550ff880a84b6939c70c1e9424157f5de93b0ff1a
SSDEEP

768:k2L7RLPL9WyoDKknfLuE6q37nsVfNyxPWZFSH:bLPL7mKkRnLnsVfNhZAH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5cea1e8af6c2186067a84e91e6bed265fed0e3aa122b917a339af83adb551467

Files

5cea1e8af6c2186067a84e91e6bed265fed0e3aa122b917a339af83adb551467
.dll windows x86

811bc708a9d51e89b829c44cd51cd3dd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord1176
ord1575
ord1168
ord1577
ord1182
ord342
ord1243
ord1570
ord1253
ord1255
ord6467
ord1578
ord600
ord826
ord269
ord823
ord1197
ord825
ord1116

msvcrt

rewind
fputc
strcat
puts
exit
_iob
fseek
printf
calloc
_initterm
_adjust_fdiv
??1type_info@@UAE@XZ
__dllonexit
_onexit
fflush
vsprintf
fclose
fread
fwrite
sprintf
strcpy
fopen
_fdopen
fprintf
ftell
_errno
memset
strlen
malloc
_EH_prolog
__CxxFrameHandler
memcpy
free
putchar

kernel32

LocalFree
LocalAlloc

Exports

Exports

A2Gzip
Gzip2A

Sections

.text
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 896B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ