9b3b49b5e1f720e2807db1aab7accc1f | Triage

Sharing

General

Target

9b3b49b5e1f720e2807db1aab7accc1f
Size

15KB
MD5

9b3b49b5e1f720e2807db1aab7accc1f
SHA1

d83e5e56cd915e24a8c68f87eaa7d5a0a8027f72
SHA256

7c1283d1f4c50d899278f86d956c79fe954eb03bf36022197376339c60c426ee
SHA512

03c257684fee284d8f6fbb5d8bbcba51d622f820e78ef8c465c8582eb4679519b47bbe3b33e42d6529b5d7248d817086bbb782a959a90173a1e2fc221f274174
SSDEEP

192:HKrOtYAG31Woq74WALVtZJFKIS//c17Y/H0JH08lYH0yH08lg0bH08l:HKGYAGkj7U/ZTS/017Y/CvYNvHv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9b3b49b5e1f720e2807db1aab7accc1f

Files

9b3b49b5e1f720e2807db1aab7accc1f
.exe windows:6 windows x86 arch:x86

cf40cb9a5bbc1733822d364b22182af8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

SHRegEnumUSKeyW
UrlUnescapeW
PathRemoveBlanksA
StrCSpnIA
PathAddBackslashA
PathIsUNCA

kernel32

VirtualProtect

wininet

SetUrlCacheEntryGroup
FindCloseUrlCache
FtpRemoveDirectoryW

wsock32

send
WSACancelAsyncRequest

oleaut32

BSTR_UserSize
QueryPathOfRegTypeLi
VarDateFromUdateEx
SafeArrayAllocDescriptor

msi

ord57
ord77
ord16
ord90
ord42
ord19
ord98

wsnmp32

ord203
ord602
ord204
ord320
ord102

winmm

waveInClose
waveInGetDevCapsA
auxSetVolume
PlaySoundA

user32

GetDC
GrayStringA

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gty
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ