0b91635ffe5addf8f316326500832bcd | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0b91635ffe5addf8f316326500832bcd
Size

295KB
MD5

0b91635ffe5addf8f316326500832bcd
SHA1

2c7e66bd0a39578a9d0c95e01ee63339931de860
SHA256

9a0e2fdea5e9fdf0d38877c9eceb96ee0d88cb7747de46c60abdec3a1e401e53
SHA512

6a65c3f338ae368f9758e8e3b62521fd78da1905d2a8c42b4f22e07ab58d647d62019408b1894ad32985f39611877738f0b33d49cfa32ba946b1955520f3b577
SSDEEP

6144:UeFRXtN40Z82DI71vWaOmNcdGBIybVg1ngKLNIdD3EZGhp2WS9Y:UeFPh479WapcdCIUVKgKLORUIDIY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0b91635ffe5addf8f316326500832bcd

Files

0b91635ffe5addf8f316326500832bcd
.exe windows:5 windows x86 arch:x86

1bd434bd4e18fc60cc9cc41c55bcff93

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

EnumWindows
GetCapture
GetScrollInfo
SetWindowTextA
RegisterClassExW

gdi32

GetArcDirection
GetRegionData
DeleteObject
CreatePolygonRgn
GetRgnBox

ole32

OleSetAutoConvert

comctl32

ord17

advapi32

IsValidSecurityDescriptor

kernel32

HeapFree
GetTickCount
GetEnvironmentVariableA
GetStartupInfoA
HeapDestroy
SetEndOfFile
FreeLibrary
LocalSize
LoadLibraryA
GetProcAddress
IsValidCodePage
HeapAlloc
HeapCreate
DeleteCriticalSection
InitializeCriticalSection
LocalFree
LocalAlloc
GetDateFormatA

Sections

.text
Size: 289KB - Virtual size: 288KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ