0349f837e926d5295e39673053a2a36b | Triage

Sharing

General

Target

0349f837e926d5295e39673053a2a36b
Size

1023KB
MD5

0349f837e926d5295e39673053a2a36b
SHA1

5bea43a8bef3982da77f3ec19cda4d6d945e2c5a
SHA256

0023418a6dc4dcac4130b0fb9333851f4763a04238ad0559c6e2e675e384476e
SHA512

9fa10a1fc11acb0ee791922d7d0cecd1514b8366d2eea12c2a04bcc04a9bc4a17672ac3dde421c69db6bc3e116a583501be823511caaec1700da120a33b5ce94
SSDEEP

24576:Y8yeBUjG6IaGJ6x/lHehwsN4fNBGOLtbp8Yj0Sxp:Y+Ui6ABhlKBGctbp8tSxp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0349f837e926d5295e39673053a2a36b

Files

0349f837e926d5295e39673053a2a36b
.exe windows:4 windows x86 arch:x86

8fdab5ef260e363fb28f8814992a8211

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetProcAddress
LoadLibraryA
CloseHandle
Sleep
GetCommandLineA
GetVersionExA
FreeLibrary
GetFileSize
lstrcpyA
CreateEventA
GetVersion
lstrlenA
GlobalAlloc
LocalAlloc

gdi32

CreateCompatibleDC
GetTextExtentPoint32A
BitBlt
GetBkColor
SetBkMode
ExtTextOutA
DeleteObject
CreateFontIndirectA
CreateSolidBrush
SetROP2
GetStockObject

Sections

.text
Size: 1024B - Virtual size: 987B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 979B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 448B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1016KB - Virtual size: 2.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ