940e474406e19a34bb55378ed17e4116c3c1c1785ea43ee700c596013679f92a | Triage

Sharing

Copy URL Twitter E-mail

General

Target

940e474406e19a34bb55378ed17e4116c3c1c1785ea43ee700c596013679f92a
Size

3.4MB
MD5

e1b3d575452d63e42705c23d28926ba0
SHA1

80b0afc2ab7f42b565c0ab4df30a071389eeeedd
SHA256

940e474406e19a34bb55378ed17e4116c3c1c1785ea43ee700c596013679f92a
SHA512

baf66a271c30872a1c412908b52e3ab3f2aadb2a4ef72c7efdf957547fe5a3eb4c1d80c3ad2d5eacc6a467b092299c790794a5b9eb27a180c148ce1bf61f736f
SSDEEP

98304:h6QC9gIFZ8QRTHdNR+EsJ/efYxIThbS1/SX0qONX:h6Q6gIFZlH7R+EsBeQCTh90h

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
940e474406e19a34bb55378ed17e4116c3c1c1785ea43ee700c596013679f92a

Files

940e474406e19a34bb55378ed17e4116c3c1c1785ea43ee700c596013679f92a
.exe windows x86

7482cada4e6b6caa80e405a4cd9f5593

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

advapi32

CryptAcquireContextA

version

GetFileVersionInfoA

wsock32

WSAAsyncGetHostByName

winspool.drv

ClosePrinter

comctl32

FlatSB_GetScrollInfo

comdlg32

GetOpenFileNameW

gdi32

AbortDoc

msimg32

AlphaBlend

shell32

SHGetFileInfoW

user32

ActivateKeyboardLayout

winmm

sndPlaySoundA

ole32

CLSIDFromProgID

oleaut32

CreateErrorInfo

gdiplus

GdiplusStartup

Sections

.text
Size: 3.4MB - Virtual size: 9.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE