40c3aaa672c9def65768aa8579ac2565 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

40c3aaa672c9def65768aa8579ac2565
Size

272KB
MD5

40c3aaa672c9def65768aa8579ac2565
SHA1

f5f5a510ee77bb1c5c738cc719367ba0a50c2b52
SHA256

98bc62a879b954e419d0cd500dc35c6288b8d5a571fa224b53a689bb447dd3b6
SHA512

cd7b2e6b83a1499c376cb7749e14da30417a4f38b018693314b7bdf371b88cb8fde87f0fe64c8e167cd329020933264f0bc1206c2b2cf6873430aaf7942d2147
SSDEEP

6144:3JIsyCPtD4jfVcoPN+UjRK4vAyg722c0B/rgZQL27k6Ctfj3q7rdYzMj:3JzWfdN+cRPAyNsBEg2Y6CQ7rGz4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
40c3aaa672c9def65768aa8579ac2565

Files

40c3aaa672c9def65768aa8579ac2565
.exe windows:4 windows x86 arch:x86

0d883da1a418ccd1eba26dedae51bb15

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetFileType
VirtualProtect
GetOEMCP
GetConsoleMode
GetCommandLineW
GetModuleHandleA
GetACP
HeapFree
SetStdHandle
SetConsoleCP
VirtualFree
FindFirstFileW
UnlockFile
HeapAlloc
GetStartupInfoA
ExitProcess
FindNextFileW

msvcrt

_exit

user32

SetRectEmpty
MessageBoxA
SendDlgItemMessageA
CreateWindowExA
KillTimer
GetWindowPlacement

gdi32

CreateCompatibleDC
SetStretchBltMode
BitBlt

advapi32

OpenThreadToken
RegOpenKeyExA

rpcrt4

I_RpcBCacheFree

Sections

.text
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 978B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 214KB - Virtual size: 752KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ