0c350212ce1b5df2e79a8dff8fe3c900 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0c350212ce1b5df2e79a8dff8fe3c900
Size

424KB
MD5

0c350212ce1b5df2e79a8dff8fe3c900
SHA1

0ead99cc14a53e8ef1fbabfdc58919cc8d99f00c
SHA256

791c0cbb693ab11a785fee6da29ab7d3cb859d024860cb9026acc72869d40d44
SHA512

786a7e3bdba8421e35f6dee1a46a4962886c8fc52d6e80aa095b2f957eb4f2288dcd84f90ddd5925fe129e114a74c6aaa0dea5d046ff6af5dbabcaa905068b0c
SSDEEP

12288:L16h5mf3I2iwDzgn3Y5h6sriJdSEaE6YgIr:LQXa3Kw/gnShkSE6YR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0c350212ce1b5df2e79a8dff8fe3c900

Files

0c350212ce1b5df2e79a8dff8fe3c900
.exe windows:4 windows x86 arch:x86

f36bff1675c98a43d5f294b8b947a0a9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetSystemDirectoryA
InterlockedExchange
EnterCriticalSection
LoadLibraryExA
VirtualProtect
SetErrorMode
GetLogicalDrives
ReleaseMutex
FindFirstFileExA
HeapCreate
GetLocaleInfoA
GetLastError
CloseHandle
GetCommandLineA
RaiseException
Sleep
SetEvent
GetACP
GlobalFree
ResetEvent
GetStdHandle

user32

SetForegroundWindow
GetParent
IsIconic
FillRect
ReleaseDC
GetFocus
FrameRect
BeginPaint
FlashWindowEx
GetClassNameA
wsprintfA
GetCursorPos
ShowWindow
GetActiveWindow
EndPaint
DrawTextA
GetWindowTextA
ValidateRect
GetWindow

dnsapi

DnsApiAlloc
DnsStatusString
DnsFree
DnsApiRealloc
DnsApiFree

clbcatq

CoRegCleanup

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 696KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ