9cf2cbe42fd6a0974c0913304dd142b266b2a4d287d24f57ca080d822e0ed181 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

9cf2cbe42fd6a0974c0913304dd142b266b2a4d287d24f57ca080d822e0ed181
Size

1.9MB
MD5

c36485300d6cd08699852e8237a79353
SHA1

4701abb1096eade44edd65d02485aa3a441ff3ef
SHA256

9cf2cbe42fd6a0974c0913304dd142b266b2a4d287d24f57ca080d822e0ed181
SHA512

890410dd79a06ceda2fef9c8342b821b4affd511ec68efa3cc75bd2eeefab747f4fc9d1ce073fbdbf12523a62ec5e4e021bfea8b6705b69c48b87ce7cad3a4bc
SSDEEP

49152:r9RZ+Hc25vFu2V94eocNvLzhK3T3ZDOLOSixkJZtKy97rHndevYFyuorI:pD+1ocNvvhCT3ZiLOSixkdKyBbndevY7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9cf2cbe42fd6a0974c0913304dd142b266b2a4d287d24f57ca080d822e0ed181

Files

9cf2cbe42fd6a0974c0913304dd142b266b2a4d287d24f57ca080d822e0ed181
.exe windows:4 windows x64

0f160c1ce25c742b64d1ff7859ae3f1f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

AddAtomA

msvcrt

___lc_codepage_func

iphlpapi

GetInterfaceInfo

psapi

GetMappedFileNameW

user32

GetWindow

advapi32

RegSetValueExA

shell32

SHGetFolderPathW

Sections

.text
Size: 144KB - Virtual size: 648KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sedata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 222KB - Virtual size: 224KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sedata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ