1a1fca2482d122432d064ca8f6ccc937 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1a1fca2482d122432d064ca8f6ccc937
Size

431KB
MD5

1a1fca2482d122432d064ca8f6ccc937
SHA1

8267c820712a71c9424bf5552f031295d3ffef3c
SHA256

19e82349806f02a1207cbc85e6f66f172985bc12820e88235ea9b9b7db7b391d
SHA512

0eee76787c581089c6f6d5965a0829d143635bfe265e06198a7bb49069cd887a1487a681409748581eaabb2cabf20ca9ce87f233d1defdedfb31ccbb62c9fc39
SSDEEP

12288:Ju4Xe7OgUJTzg2FYnqbDqFkJPpSi5fY1:cUgAzfDpxSi5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1a1fca2482d122432d064ca8f6ccc937

Files

1a1fca2482d122432d064ca8f6ccc937
.exe windows:5 windows x86 arch:x86

350a6b632b530ab093ce83731cc48eac

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

RegisterClipboardFormatA

gdi32

SetMapMode

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA

advapi32

RegQueryValueA

shell32

SHGetPathFromIDListA

comctl32

InitCommonControlsEx

shlwapi

PathFindFileNameA

oledlg

ord8

ole32

CoRevokeClassObject

oleaut32

SysFreeString

Sections

.text
Size: 415KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE