35f16673b10aadff389345f49ca683a3cbb28c99b948eb138aa3aadea6df9adf | Triage

Sharing

Copy URL Twitter E-mail

General

Target

35f16673b10aadff389345f49ca683a3cbb28c99b948eb138aa3aadea6df9adf
Size

3.7MB
MD5

6194419f4032e7d2295924fcfed80759
SHA1

ae37fae03949b3aa65fb4a9b9da348335619d80a
SHA256

35f16673b10aadff389345f49ca683a3cbb28c99b948eb138aa3aadea6df9adf
SHA512

d0e649cbf27c3e271ea81ff3ae8fb85a0c031d1c10baba778765a8cb2f8969be941a57e45c1dacc1ce36cf895df13c4577b92ff57487110e32ae347f10545986
SSDEEP

98304:ebdeXyMZ4kU+2z20nX2+OaXgMmah0lZ8vBfgiQc9pL:eiZtSq+250Jmg8Z8v5glOpL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
35f16673b10aadff389345f49ca683a3cbb28c99b948eb138aa3aadea6df9adf

Files

35f16673b10aadff389345f49ca683a3cbb28c99b948eb138aa3aadea6df9adf
.exe windows x86

fef777dd92b68f64de22c1b8b410e334

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersion
GetVersionExA
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

GetProcessWindowStation
GetUserObjectInformationW

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 276KB - Virtual size: 274KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmps0
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmps1
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ