00dcc09dd3a3b8a39a61c9a575ef02a8 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

00dcc09dd3a3b8a39a61c9a575ef02a8
Size

147KB
MD5

00dcc09dd3a3b8a39a61c9a575ef02a8
SHA1

d9e1b8293d319541ccb8611127f1c4e6fb168720
SHA256

1725fb9df527df34cd22c4b5fb0aeab5a7f42378616114861d3b8af0f8a7c819
SHA512

b49212ae81958aee0370ab97d1f2c7f1bab76bdbe6c060fb7ab208e4a46889cc507b984f610a54fd0bfda93ae7223d873e3b401925cea58e31ec7b1e3b4b6257
SSDEEP

3072:HVxMAmeBZ7u4PUNAA5a2t/VG8Ny865wc8SRH710sVL3X:1KCBVHEAA42tM8k8zoH7WW3X

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
00dcc09dd3a3b8a39a61c9a575ef02a8

Files

00dcc09dd3a3b8a39a61c9a575ef02a8
.exe windows:5 windows x86 arch:x86

e617d841c96e57aa3dc790b08f73d2a9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrToIntA
PathStripPathW

kernel32

GetModuleHandleA
lstrcmpA
LoadLibraryExA

Exports

Exports

?ExpandEnvironmentSampleStringsA@567GPAUHINSTANCE__@@U_COMMPROP@@?F
?ExpandEnvironmentSampleStringsW@567GPAUHINSTANCE__@@U_COMMPROP@@?F
?ZeroAccesA@567GPAUHINSTANCE__@@U_COMMPROP@@?F
?ZeroAccesW@567GPAUHINSTANCE__@@U_COMMPROP@@?F

Sections

.bss
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 117KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.itext
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ