3828435fd4e319d768671eb29ebd5929 | Triage

Sharing

General

Target

3828435fd4e319d768671eb29ebd5929
Size

636KB
MD5

3828435fd4e319d768671eb29ebd5929
SHA1

6e624e4a64ffde17462f92eecf9de6096fbcda46
SHA256

dcfc48d06f03dfa8bf5f3fd4541719548b67d431306b8356367f5ad776b446f7
SHA512

56c05283eb41ad2617b7ef5632b5b1c8a856862e771dffe8482cb8ff97115239ffbaac0edc4170ebd204ac0c876eab7cc62f4a95d3a28259da9f182adde4433e
SSDEEP

12288:IXsETlBnPVibcHXn+XrKiE9DamsHaEcdrVQilrJQwhe9aEAyvU:UsEJR8bwfUH8rVQilrmwA9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3828435fd4e319d768671eb29ebd5929

Files

3828435fd4e319d768671eb29ebd5929
.exe windows:4 windows x86 arch:x86

dbc3cb7edda0c6f7b1f19fbb951730c4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalUnlock
HeapCreate
GetConsoleDisplayMode
GetSystemDefaultLangID
GetTickCount
SuspendThread
CloseHandle
InterlockedExchange
GetModuleHandleA
WaitForMultipleObjects
GetAtomNameA
LoadLibraryExA
GetCommandLineA
VirtualProtect
GetVersion
WaitForSingleObject
CompareFileTime
LocalSize
HeapReAlloc
lstrlenA
GetConsoleCP

gdi32

CreateICA
GetMetaRgn
DeleteDC
CreatePalette
GetMetaFileA
BeginPath
GetRgnBox
FloodFill
GetStringBitmapA
EqualRgn
CreateFontA
DeleteObject
Ellipse
EndPath
AbortPath
GetTextColor
GetFontData
EngLineTo
Escape

rastapi

DeviceConnect
PortClose
DeviceListen
AddPorts
DeviceDone

dhcpsapi

DhcpAddServer

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ