2845eeea12edd80f79114476f41afa46 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2845eeea12edd80f79114476f41afa46
Size

32KB
MD5

2845eeea12edd80f79114476f41afa46
SHA1

5386eb8aceebf66572b33c4fc7f61677a66aad6a
SHA256

768e5d9e9f260108cd6605a7fd84767e1227f44bdc173b1af40d1968a69f0b97
SHA512

14d116569cb2b1bab3dfc004941fd23d0ecc3df2c4d89d687e37dbc949c1c94566fce2277355ca093581da2a8a584578edc602936399c468a8d92a8e0a09dc9c
SSDEEP

768:ocCJaklYh+Qt7t3hSaH2vTFLFjimbsrb2:ePlYhvZ/SaH2vTtvbIb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2845eeea12edd80f79114476f41afa46

Files

2845eeea12edd80f79114476f41afa46
.exe windows:4 windows x86 arch:x86

317518743e07e82997b935c527c2596c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FreeLibrary
GetProcAddress
LoadLibraryA
Sleep
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
CloseHandle
CreateProcessA
lstrlenA
WriteFile
CreateFileA
GetSystemDirectoryA
ReadFile
GetFileSize
MoveFileExA
CreateThread
GetTickCount
GetWindowsDirectoryA
GetModuleFileNameA
GetStartupInfoA
GetModuleHandleA

msvcrt

isalpha
rand
__CxxFrameHandler
_EH_prolog
strcpy
islower
??2@YAPAXI@Z
memset
strstr
pow
wcslen
strcat
sprintf
??3@YAXPAX@Z
strlen
free
strchr
strrchr
atoi
srand
strncmp
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_strdup
_putch
printf
wcsncmp
_stricmp

user32

GetWindowTextA
GetWindowLongA
SendMessageA
CloseWindow
CharLowerA

oleaut32

SysFreeString
SysAllocStringLen
VariantClear
SysAllocString

Sections

.rdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE