cff518736a9f59fd330aff8c7d58689d1e68cb596b7ccc5e6bfe0a6c7b4fe3ea | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cff518736a9f59fd330aff8c7d58689d1e68cb596b7ccc5e6bfe0a6c7b4fe3ea
Size

4.1MB
MD5

0cf6b2b92b5e7146153d49b145547678
SHA1

8f8183622d21506f9571d880c4148a5674725988
SHA256

cff518736a9f59fd330aff8c7d58689d1e68cb596b7ccc5e6bfe0a6c7b4fe3ea
SHA512

16528da1703bbfc1f556f87725436271efa78256404b4493b330164345a0f095f3552cc71e5025a5937a351288365985da6ae2eac79dfe82b8bc49879768a62a
SSDEEP

98304:T58bZHNPh5UBingOE2+km4cL2UNBZdcvjWW9N:T5mZdTeXqcKULU19N

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cff518736a9f59fd330aff8c7d58689d1e68cb596b7ccc5e6bfe0a6c7b4fe3ea

Files

cff518736a9f59fd330aff8c7d58689d1e68cb596b7ccc5e6bfe0a6c7b4fe3ea
.exe windows:5 windows x86

f427ec01d51b9c584dcb332a494f35bf

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

oleaut32

SysFreeString

advapi32

RegQueryValueExA

user32

GetKeyboardType

gdi32

UnrealizeObject

version

VerQueryValueW

mpr

WNetGetConnectionA

ole32

CreateStreamOnHGlobal

comctl32

_TrackMouseEvent

shell32

ShellExecuteA

comdlg32

GetOpenFileNameA

wsock32

WSACleanup

gdiplus

GdipSetStringFormatLineAlign

Sections

.text
Size: 3.7MB - Virtual size: 8.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE