f1b3ae7309941128248c9c15f6e44ee5 | Triage

Sharing

General

Target

f1b3ae7309941128248c9c15f6e44ee5
Size

60KB
MD5

f1b3ae7309941128248c9c15f6e44ee5
SHA1

0c22b67a61c9cda73f3c978f71c470451e211e21
SHA256

ccd886f017cf9e046e0657773d2fd1812d60e018066bae7fc57efa8d83058957
SHA512

7aa6a3bd9ad31342361b76d991a5c6edf6ab57ead5c6c755096a3dcbe91f42ce44d289d07e14d645e1d1ad81cbb5cc914c0ce8dd558c7921d9f8f58b0dc62f3a
SSDEEP

1536:wgOzqIfhbp1pj7lsRD8tT/9SztLmuttq2vXlEws6dMETgQtewNhJ3FEPYPb1:wTsRD8mzPXlEwssMETg2fxjPb1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f1b3ae7309941128248c9c15f6e44ee5

Files

f1b3ae7309941128248c9c15f6e44ee5
.exe windows:4 windows x86 arch:x86

e44a1a53d103625a40f60599ebe9f749

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memset
memcpy
_CIlog
_CIpow
strlen
memmove

kernel32

GetModuleHandleA
HeapCreate
HeapDestroy
ExitProcess
CloseHandle
InitializeCriticalSection
WaitForSingleObject
PeekNamedPipe
HeapAlloc
HeapFree
EnterCriticalSection
HeapReAlloc
LeaveCriticalSection
TlsGetValue
TlsSetValue
TlsAlloc
WaitForMultipleObjects
GetCurrentThreadId
GetCurrentProcess
GetCurrentThread
DuplicateHandle
CreateSemaphoreA
CreateThread
ReleaseSemaphore

user32

CallWindowProcA

wsock32

closesocket
WSACleanup
WSAStartup

Sections

.cod
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.d...
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ