79e430d66abf22f05a23c3b5581050aeff56ac941c7a71fdccdbb389f7aa1981 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

79e430d66abf22f05a23c3b5581050aeff56ac941c7a71fdccdbb389f7aa1981
Size

12.6MB
MD5

c7ecc1268b2c5ed80fc8fdd4396fd620
SHA1

a2227d08fc939beeaaadb38edee818cb7359bcf2
SHA256

79e430d66abf22f05a23c3b5581050aeff56ac941c7a71fdccdbb389f7aa1981
SHA512

02ea7108a7fbb475a2bd07f4f2b2f0caa23be11af7df7b090b68b05c88e77dfa5a4d1a8b94b89b3d2164efb287fe919c40377a3146991374f97186951f28a0b6
SSDEEP

12288:0z+wSUpBMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM:0z8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
79e430d66abf22f05a23c3b5581050aeff56ac941c7a71fdccdbb389f7aa1981

Files

79e430d66abf22f05a23c3b5581050aeff56ac941c7a71fdccdbb389f7aa1981
.exe windows:5 windows x86

45b3bc45f71f6d9e40582b43454bd6fe

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetEnvironmentVariableA
TlsGetValue
VirtualAlloc
DeleteFileW
GetModuleHandleW
CreateEventA
SetSystemTime
GetCurrentDirectoryA
CreateMailslotA
LoadLibraryA
SleepEx
GetCurrentThread
OpenJobObjectA
GetShortPathNameA
MoveFileExW
WaitForSingleObject
OpenEventW
TerminateProcess
CreateFileA
RemoveDirectoryW

comsvcs

RecycleSurrogate
SafeRef
CoCreateActivity

ctl3d32

Ctl3dEnabled
Ctl3dCtlColor
Ctl3dUnregister
Ctl3dGetVer

Sections

.text
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

udata
Size: 1024B - Virtual size: 704B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ldata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_MEM_READ

.relc
Size: 12.5MB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE