015a5137438ed403a404986d406525f0 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

015a5137438ed403a404986d406525f0
Size

328KB
MD5

015a5137438ed403a404986d406525f0
SHA1

f8f2429d829184562dc34193f1956ce208e760a7
SHA256

15ccf389a5911236908d5b17eb17305c55c8faa031c66df84ab28fcbbfd86991
SHA512

9772ab1978f9f39f66bdc1897ea8eb19ac8e8bb8328f706547ce8a01b3379fc5184fbd300b3fe7c5b98d607135c9004a088971e44cc8075eb8cb467ac4112842
SSDEEP

6144:NWbd5Qj+J7sIZn93Cw7iz0U0SlYJ2hUH+0wQKU5BjXz6fQBsl3TLVs/i:qd5pGqE8y/0SphU8QKU5NzrslWi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
015a5137438ed403a404986d406525f0

Files

015a5137438ed403a404986d406525f0
.exe windows:5 windows x86 arch:x86

8f655731b0fa0dd7879d6015bb4e144f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

comctl32

ImageList_ReplaceIcon

shlwapi

SHSetValueA

psapi

GetModuleFileNameExA

version

GetFileVersionInfoA

msimg32

AlphaBlend

user32

GetIconInfo

gdi32

CreateCompatibleDC

comdlg32

GetSaveFileNameA

advapi32

GetTokenInformation

shell32

SHGetFolderPathA

ole32

CoUninitialize

oleaut32

SafeArrayDestroy

winhttp

WinHttpQueryDataAvailable

Sections

.text
Size: 319KB - Virtual size: 788KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE