0cd1e3e4181803c81e500412fbe79b70 | Triage

Sharing

General

Target

0cd1e3e4181803c81e500412fbe79b70
Size

204KB
MD5

0cd1e3e4181803c81e500412fbe79b70
SHA1

bf69949401e43145e962537df925e5b7a7246864
SHA256

7dd8befa6135e039fd241d52e4975b3bc1268e24e4e0dcae1c0699ab482b404b
SHA512

d876f9c64842c3a9821464deb7c3154b196239afad679ffa58e2c3d0aa09d1c2e1be71f1a62eebc851eb6f82b2a77c775e7e5ae14ea3ff45001299d56bdf0558
SSDEEP

6144:WpAKPdcFEABgdr5yKzq+DbJqEWHmipRE1OQJveZoTdf:kAGcFEA6q+3JqpHmDHVeZy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0cd1e3e4181803c81e500412fbe79b70

Files

0cd1e3e4181803c81e500412fbe79b70
.exe windows:4 windows x86 arch:x86

c593d67944fa7d8f28481d4242386760

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

CreateFiberEx
FoldStringW
GetLastError
TerminateJobObject
GetLocaleInfoW
TlsGetValue
EnumResourceNamesW
Sleep
FlushFileBuffers
TlsAlloc
LoadLibraryA
TlsFree
GetCurrentThreadId
VirtualProtect

user32

MapVirtualKeyW
LoadIconW
RealGetWindowClass
GetSystemMetrics

setupapi

SetupDiGetDeviceRegistryPropertyW
CMP_WaitNoPendingInstallEvents
CM_Get_DevNode_Status

msimg32

AlphaBlend

Sections

.text
Size: 186KB - Virtual size: 185KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 352KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ