20e66bb24fa0cc95ff694c1f513e35e1 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

20e66bb24fa0cc95ff694c1f513e35e1
Size

469KB
MD5

20e66bb24fa0cc95ff694c1f513e35e1
SHA1

734e932f6c817618395134aa8c73443570fe5d08
SHA256

d94562ff8ca358dc37a222a3a91d7f1f0b96a782932e722f32d5c529410907f7
SHA512

2eb8ff23162aef4b10c88e39cd0b4f6f1fe1fa0eb9ad026facfc656d03992b868b9f78160831a02d7a1d764f2389e75bbdd4ce2c85bc3c2c64cee0cf5bb89923
SSDEEP

12288:RIbnq5ORFftIiB6gBFvST9kFO14SFoktWEY+ucXz+J6nJELcUmQ+77:RIbq0ft8gLvoko1hmkQ5cXzyvL/O

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
20e66bb24fa0cc95ff694c1f513e35e1

Files

20e66bb24fa0cc95ff694c1f513e35e1
.exe windows:5 windows x86 arch:x86

ac99a5a6590e07f40380584be971cd01

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetModuleHandleA
GetProcAddress

oleaut32

SysFreeString

advapi32

RegCloseKey

user32

CharNextW

msimg32

AlphaBlend

gdi32

Pie

version

VerQueryValueW

ole32

IsEqualGUID

comctl32

ImageList_Add

shell32

ShellExecuteW

comdlg32

GetSaveFileNameW

winspool.drv

OpenPrinterW

Sections

.MPRESS1
Size: 458KB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE