1f94557f0b2bc3a327ec2a1032774705 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1f94557f0b2bc3a327ec2a1032774705
Size

208KB
MD5

1f94557f0b2bc3a327ec2a1032774705
SHA1

11c458aef5d8657fe13d2d60a729910372c6f767
SHA256

4a2b844ea926332df491a2b9e801a3867f28167846a024fcee4a528a41c6b11a
SHA512

cb441cab97164b9b84932410c3321ae31134668bbbbc2db9673c3f5c8eec58dfe1b03bf0f7a504882375230c9b63007380fabf8aa1047313682999bda6ee0dc7
SSDEEP

6144:CldP0X/pw8nBjUQa+f7tI0uo1cX5h3/wR4vHBLsdtR:ysvpBnNaOMJh3oR4vHUR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1f94557f0b2bc3a327ec2a1032774705

Files

1f94557f0b2bc3a327ec2a1032774705
.exe .ps1 windows:4 windows x86 arch:x86 polyglot

691f1193f16065947032ace3a2329e55

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

msvcrt

fabs

comctl32

InitCommonControls

user32

IsChild

gdi32

BitBlt

ole32

CoInitialize

shell32

ShellExecuteExA

shlwapi

PathQuoteSpacesA

Sections

.MPRESS1
Size: 203KB - Virtual size: 752KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE