e047d836f4158d505c4c5655e8a47690_exe32[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e047d836f4158d505c4c5655e8a47690_exe32.exe
Size

200KB
MD5

e047d836f4158d505c4c5655e8a47690
SHA1

5e3f358bc872c105ad28d82631f227be1f085e84
SHA256

b0eaf1116a6e77b286cac3e879c757d969d2b8eb892590ed6cd20db6741fbd51
SHA512

97887676b13e5d48bd1c28486c350375fe589abfcc645b30806367ec144b8e20efcef5deb2dde660c3b6712f3dcb35b587d2ecb54d6d30a9563c2465cea2548a
SSDEEP

3072:1L1YiQUe3N+LJYmTHqsd7dirm4R+yvrtCOH3gDhtPDXOD2IM2D/kNMYvN3XCod:Ve3N+0sRdirm6vhCEgDht7O22LkmYVp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e047d836f4158d505c4c5655e8a47690_exe32.exe

Files

e047d836f4158d505c4c5655e8a47690_exe32.exe
.exe windows:5 windows x86

5cb0e9627b41bda8a7d3946839b91cdd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
GetProcAddress
VirtualAlloc
VirtualFree
VirtualProtect

user32

GetDC

gdi32

Escape

advapi32

OpenProcessToken

shell32

ShellExecuteW

ws2_32

recv

oleacc

LresultFromObject

winspool.drv

OpenPrinterW

oleaut32

VariantClear

Sections

.text
Size: 94KB - Virtual size: 209KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 16KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 285KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 74KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 7KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.EEEE
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE