d71cc896f3a5565437e4989c483d7c83ed9625fa6e3d4d9b7e4b69029829d108 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d71cc896f3a5565437e4989c483d7c83ed9625fa6e3d4d9b7e4b69029829d108
Size

8.4MB
MD5

45f932b6e9329a00ed4d0fd30692ae73
SHA1

7ab05968028a96fc8e6dd77ff4005483c14226cf
SHA256

d71cc896f3a5565437e4989c483d7c83ed9625fa6e3d4d9b7e4b69029829d108
SHA512

5fc5a36b3a2267f97f3cb0c5377d9ab4239203ba78afd17a9699883ef12ccd49d818ec93eeb1d8af2dbe91190df5cd86980086f64ea3af82ed8a22d43c39c1fc
SSDEEP

196608:C0qxeZLjMF9sBk9xnv/KTYttME2mqQgCZrbSE44JhZ8jlDqyMq:cxgvMIBk9xnv/Kk0E2mbgEWL4JhZsp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d71cc896f3a5565437e4989c483d7c83ed9625fa6e3d4d9b7e4b69029829d108

Files

d71cc896f3a5565437e4989c483d7c83ed9625fa6e3d4d9b7e4b69029829d108
.exe windows x64

58195c87a65d5d06bea9db79b004b909

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

user32

CreateWindowExW

comctl32

ord380

kernel32

IsValidCodePage

advapi32

OpenProcessToken

gdi32

SelectObject

iphlpapi

GetInterfaceInfo

msvcrt

_wcsnicmp

psapi

GetMappedFileNameW

shell32

SHGetFolderPathW

Sections

.text
Size: 144KB - Virtual size: 504KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sedata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 118KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sedata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
loader.pyc