015aa67a3414d3b836ff336680c0cff1 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

015aa67a3414d3b836ff336680c0cff1
Size

319KB
MD5

015aa67a3414d3b836ff336680c0cff1
SHA1

75c14843eb701a3254f12186ce72c92a1ad6157c
SHA256

3a0792bee4d6b1003223ab78d18e4806856b6e614ff9ac9abb066f7bd4e241c9
SHA512

e28f2230e665163af17dbb1fa1c9535727b82d216c9c659b71198e8caefce16c5b5e71231b84796d770f0791b150ee546fdedf555362309e30a83d14c55d5c9a
SSDEEP

6144:XeETZg6rcOEdsSEP1RqEP7oXMDUUvr1c6tQY:XrZgKHYs9RrT0UUUZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
015aa67a3414d3b836ff336680c0cff1

Files

015aa67a3414d3b836ff336680c0cff1
.exe windows:4 windows x86 arch:x86

92112eaca22d550bbab8bed6a61c7bf0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ResumeThread
VirtualFree
Sleep
GetLastError
CloseHandle
WriteFile
GetExitCodeThread
OpenFile
ResetEvent
VirtualUnlock
VirtualLock
GetCurrentProcess
GetModuleHandleA
GetSystemDirectoryA
GetTempFileNameA
GetProcAddress
CreateEventA
HeapFree
HeapAlloc
HeapReAlloc
GetCurrentProcessId
VirtualAlloc
VirtualQuery
OpenMutexA
RtlUnwind
LoadLibraryA
TerminateProcess
GetModuleFileNameA
GetSystemTimeAsFileTime
GetCurrentThreadId
TerminateThread
GetTickCount
QueryPerformanceCounter
ExitProcess

user32

CreateWindowExA
EnumWindows
IsWindowVisible
IsChild
SetTimer
InSendMessage

gdi32

SelectObject

advapi32

OpenProcessToken

ole32

CoUninitialize

psapi

GetModuleInformation

msvfw32

ICCompressorFree
DrawDibClose
DrawDibBegin

avifil32

AVIFileInfoA

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 276KB - Virtual size: 273KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 366KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ