e633def7297cefb50e8dfb422d1d0aa76d1e15e12b064f8451ad435d690d9f05 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e633def7297cefb50e8dfb422d1d0aa76d1e15e12b064f8451ad435d690d9f05
Size

2.5MB
MD5

e8ece029ff20562a1c845f90a4d32e62
SHA1

c29348e9400ab2e1b628fe5bb0a8df75ddd7c1c0
SHA256

e633def7297cefb50e8dfb422d1d0aa76d1e15e12b064f8451ad435d690d9f05
SHA512

e4d41473cdcafe90892b254dd58a88f1ac7cb3d23c62f1c521fa1f62e2b239176e4145c95d5d59a6e920e2c48c488d5b879a2a14e12a6092e570dc090be963f5
SSDEEP

49152:SQL1yFJS0JGitT+h2+dEbR/L+YTM7uSeJ9m/gEYySiJGDy2L8s5nn:9LkF1TT+h2vLvTM7uSenSCLBJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e633def7297cefb50e8dfb422d1d0aa76d1e15e12b064f8451ad435d690d9f05

Files

e633def7297cefb50e8dfb422d1d0aa76d1e15e12b064f8451ad435d690d9f05
.exe windows x86

cfca565c5f007c1ca324b7fd1d358d87

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

mpr

WNetGetConnectionA

version

VerQueryValueA

gdi32

UnrealizeObject

ole32

IsEqualGUID

comctl32

ImageList_SetIconSize

winspool.drv

OpenPrinterA

shell32

Shell_NotifyIconA

wininet

InternetReadFile

comdlg32

PageSetupDlgA

wsock32

send

pquery.bin

WyQueryPYWhole

msvcrt

_gcvt

idcardreader\termb

Read_Content

idcardreader\dll_file

unpack

lz32

LZOpenFileA

Sections

CODE
Size: 2.5MB - Virtual size: 10.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 60KB - Virtual size: 88KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE