2051ec7475ee0578b7ac82f1c9f41709 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2051ec7475ee0578b7ac82f1c9f41709
Size

209KB
MD5

2051ec7475ee0578b7ac82f1c9f41709
SHA1

c6b977aa431f97b95597f97d0b2c4445c7e7c5a8
SHA256

de91cb0e1b9702a203832d02c28b6ae6ea9ec78bfcbe39bea2ffddeb66619781
SHA512

5905acc2c1f8e8e9d3b5a21fa9f60357176f2d372bf4f99fa0ad9bfc34a41ae236414933ee9583c7d10ef73bd08d62227677d950f1b115d3411b1c2beba50b98
SSDEEP

6144:ul2/rrpjUBE6s0DFUVI1MDj/5s0/M7G7:3JeE6s0Jwy4xT/M7G7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2051ec7475ee0578b7ac82f1c9f41709

Files

2051ec7475ee0578b7ac82f1c9f41709
.exe windows:4 windows x86 arch:x86

691f1193f16065947032ace3a2329e55

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

msvcrt

fabs

comctl32

InitCommonControls

user32

IsChild

gdi32

BitBlt

ole32

CoInitialize

shell32

ShellExecuteExA

shlwapi

PathQuoteSpacesA

Sections

.MPRESS1
Size: 204KB - Virtual size: 752KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE