403d83e11acb05e21ee79d3c9d054fa0 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

403d83e11acb05e21ee79d3c9d054fa0
Size

588KB
MD5

403d83e11acb05e21ee79d3c9d054fa0
SHA1

20b02069b2c2c274fe699d4be93e620a30420d99
SHA256

6ea3ed4e0909c956535e464b4452f929b01d909e4772bdfa463e59e3851023ab
SHA512

fa79c297cba26cbd6f8d49fba2425addef3f80265162b8c1a146f0cd1ec423b22fcd2c5e4ada585a7c86b92fd3144f550b2df6fa0ee2dfec7f3c7f9c4c8bb373
SSDEEP

12288:1LmZvXJRBNGau0zPHxizSNfpT5QwtXjV/W9nNiSgoC:1LmZPJ/NBzvvrQ5d2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
403d83e11acb05e21ee79d3c9d054fa0

Files

403d83e11acb05e21ee79d3c9d054fa0
.exe windows:4 windows x86 arch:x86

d106aaf7e24f1efdd7d6308fbc085529

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

AddAtomA
ExitProcess
FindAtomA
GetAtomNameA
GetFileSize
GetModuleHandleA
GetProcAddress
OpenProcess
ResumeThread
SetThreadContext
SetUnhandledExceptionFilter
VirtualFree
VirtualProtect
VirtualQuery

msvcrt

__getmainargs
__p__environ
__p__fmode
__set_app_type
_assert
_cexit
_iob
_onexit
_setmode
abort
atexit
exit
fgetc
fopen
free
malloc
memcpy
signal

user32

LoadIconA

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 472B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 1004B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE