PhotoStory3[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

PhotoStory3.exe
Size

100KB
MD5

1aae9b679065f72e60fa27661d927c87
SHA1

87a44cb29a0ea986877c8330d64ffdae841f4b6e
SHA256

8fb1d0aff5b54ea12a2ab9945c9205b72e31d1a55913e9309c2721961fd70051
SHA512

6b61e35b80680bf4ae4bc5e2f38331b39f1ff144570e46a0eb4428248d3a7b9c41a13a887330f5472c1884267025fd8fcdb90f3cda841038f7771201b14584e4
SSDEEP

768:KFskFyZH7i2Xp9/CLVBEmMwktEliBpl6LcpZjEfYEakeyua/NceEsju0NITXa3II:KFsIMXCLVmmM9EgzMFUpowq3UO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PhotoStory3.exe

Files

PhotoStory3.exe
.exe windows:5 windows x86

af2318d257aa3758711a62d3ffb549b0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LocalFree
FormatMessageW
GetProcAddress
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCommandLineW
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
GetCurrentThreadId
GetLastError
GetStartupInfoW

msvcrt

_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_exit
exit
__wgetmainargs
_initterm
_except_handler3
_wcmdln
_c_exit
_cexit
_controlfp
_XcptFilter
__setusermatherr

user32

MessageBoxW

ole32

CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

SysFreeString
SysAllocString

comctl32

ord17

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 95KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ