05858e225acf27585d427e8269de62def4b8638c99c2e60c1cfe07ee9b2f8c66 | Triage

Sharing

General

Target

05858e225acf27585d427e8269de62def4b8638c99c2e60c1cfe07ee9b2f8c66
Size

14.3MB
MD5

2b0de73109f372f02d3fe40ac8b98016
SHA1

ab1165d69c4e3ff7429afeab213954a8d2538d11
SHA256

05858e225acf27585d427e8269de62def4b8638c99c2e60c1cfe07ee9b2f8c66
SHA512

1702cbb3052ae48ec2a16d046ddfdac274f6a8fcdb15bdd0fc4222450a3954c4339e3147cb22f76901e424cb4d8af281c797d6b3fee20af8464b2239e1254390
SSDEEP

393216:rkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkX:rkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
05858e225acf27585d427e8269de62def4b8638c99c2e60c1cfe07ee9b2f8c66

Files

05858e225acf27585d427e8269de62def4b8638c99c2e60c1cfe07ee9b2f8c66
.exe windows:5 windows x86

f5f48c4dfed4d810c761d7ca60e5263c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindFirstFileW
UpdateResourceA
GetProcAddress
lstrcpy
lstrcpyW
GetFileType
AllocConsole
LoadLibraryA
CreateFileW
GetModuleHandleW
CopyFileExA
LoadLibraryExW
OpenMutexW
CreateMutexW
GetACP

untfs

FormatEx
Format
Chkdsk
Recover
Extend

shell32

SHFileOperationA
DragFinish
SHGetDesktopFolder
ShellAboutW
SHGetFolderPathA
DragQueryFileA
DllGetClassObject
StrStrA
SHGetDataFromIDListW
ShellMessageBoxA
ShellExecuteW

ctl3d32

Ctl3dGetVer
Ctl3dUnregister
Ctl3dCtlColor

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

jdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

jdata
Size: 1024B - Virtual size: 993B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14.3MB - Virtual size: 87KB

IMAGE_SCN_MEM_READ