29359a2f4e50dead75a7ebba33de85a7 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

29359a2f4e50dead75a7ebba33de85a7
Size

312KB
MD5

29359a2f4e50dead75a7ebba33de85a7
SHA1

71dcb82b6357312bbe9107e4f5295fae3aee9a97
SHA256

40b53c0cf22b4fe04d037072283eb36138eb8d348f557767afdd679c2ac6e939
SHA512

cfdafa3301fa21f22c0e8d1ef10b0491eec305b4cc6b85dbb35c2b5894dee32b5133b1eee78badb9296a758b253c48c42b6728c5932c458a6016efea71502892
SSDEEP

6144:Y0UerEr9GevCnxGYrIs/Qg/CoLtQeeOEDsM643+UrQOvkT2xG:IerEhGeqnxGvs4g/llEW439xC20

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
29359a2f4e50dead75a7ebba33de85a7

Files

29359a2f4e50dead75a7ebba33de85a7
.exe windows:4 windows x86 arch:x86

a3b2ed0476f8e0be15176eeecc6f64c5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalFree
GetSystemDirectoryA
RaiseException
LoadLibraryExA
ResetEvent
HeapCreate
FindFirstFileExA
OpenMutexA
FlushFileBuffers
GetCommandLineA
PulseEvent
GetStdHandle
GetACP
VirtualProtect
ReadConsoleA
FindClose
SetEvent
InterlockedExchange
GetLocaleInfoA
FreeEnvironmentStringsA
IsDebuggerPresent

user32

GetParent
GetWindowTextA
ValidateRgn
GetCursorPos
GetFocus
EndPaint
BeginPaint
GetWindow
SetActiveWindow
FrameRect
wsprintfA
ShowWindow
FillRect
GetClassNameA
SetForegroundWindow
ReleaseDC
IsIconic
DrawTextA
FlashWindowEx

winmm

auxGetDevCapsA
CloseDriver
aux32Message
OpenDriver
PlaySoundA

wtsapi32

WTSCloseServer

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 692KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ