3e13d17e887886024e7383e6f0fb5bae | Triage

Sharing

General

Target

3e13d17e887886024e7383e6f0fb5bae
Size

252KB
MD5

3e13d17e887886024e7383e6f0fb5bae
SHA1

59c4d21a528c0262ed8a81e001f0664c5da018fa
SHA256

cf2d909309a80fd136aa09541c132d8af566dd1b1c55ced370fd7b4b8d5f9b8b
SHA512

36ca60ba137b4c2634bd3af441bb8fc6087d18d5ed3ac200cb472660239b7975158a806a3182df3178c1cb1a89cd9f61109245e750ee04f7e7a32eec37c1ea2e
SSDEEP

6144:/cuDEFwUWRDezeJgRvxUceihnGSGVxHd7uGQ:kuDEFwUWRet6onGZzHRQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3e13d17e887886024e7383e6f0fb5bae

Files

3e13d17e887886024e7383e6f0fb5bae
.dll windows:4 windows x86 arch:x86

69bc3cfe7cca88bb521c0a3a5dc537fb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

comdlg32

FindTextA
GetFileTitleA
ChooseColorA
GetOpenFileNameA
GetSaveFileNameA

msvcrt

memcmp
clock
exp
mbstowcs
wcscspn
fabs
acos
tolower

kernel32

VirtualAllocEx
GetCommandLineW
GetCommandLineA
ExitThread
IsBadReadPtr
lstrlenW
LoadLibraryExA
ExitProcess
GetProcAddress
LoadLibraryA
GetModuleHandleA
GetLastError
IsBadHugeReadPtr

Sections

CODE
Size: 224KB - Virtual size: 222KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 744B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ