00401c4ae6d90336e0b74daa4a040f24 | Triage

Sharing

General

Target

00401c4ae6d90336e0b74daa4a040f24
Size

19KB
MD5

00401c4ae6d90336e0b74daa4a040f24
SHA1

a64c1c8e69fa7e497224b8cdfe42a1028f320a76
SHA256

12d7be6a36738cc1d917f944a7a605c7a2d0b3717afb3376034521b343b21f9a
SHA512

8f50452afe3fe872877d347b7613f6833ab0b31b107f004ef6fe5a909007e9af9505c55bc1c6ea46f183187b4851ae1903d5a173c69a645957565d0aba3865a4
SSDEEP

384:qmlcZRgl5lbI3vny47444u7d4ygfTlSyZXcpSaTPjbKEmDjhoXDArm7y2:56A5lbIfnyZux0rlSyxgF7j+Jo+m

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
00401c4ae6d90336e0b74daa4a040f24

Files

00401c4ae6d90336e0b74daa4a040f24
.exe windows:5 windows x86 arch:x86

926a8304d418cf82f95dffbeb71b901d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleW
GetProcessHeap
Sleep
GetModuleFileNameW
GetLastError
HeapAlloc
GetModuleHandleA
lstrcatW
OutputDebugStringA
RtlZeroMemory
GetProcAddress
ExitProcess

user32

RegisterClassExW
TranslateMessage
BeginPaint
PostQuitMessage
GetMessageW
DestroyWindow
EndPaint
ShowWindow
CreateWindowExW
MessageBoxW
DefWindowProcW
DispatchMessageW
LoadStringW

gdi32

AbortDoc

msvcrt

memcpy
vsprintf
memset

winspool.drv

OpenPrinterA
ClosePrinter

wintrust

WinVerifyTrust

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 344B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ