35590dbaca9c44687428c49ebaa51a8a | Triage

Sharing

Copy URL Twitter E-mail

General

Target

35590dbaca9c44687428c49ebaa51a8a
Size

108KB
MD5

35590dbaca9c44687428c49ebaa51a8a
SHA1

531ab074d053ff65237129bb7378ec7a82e5604a
SHA256

5819b9d0b364e330820d1b805a32a92a4c1e58778aa962b2048290fd34334a29
SHA512

222b237455adccb8c16e29ee973757e7b62f48b3d7d58db13ee9ef1546b0d6486c7c2608ba4f440770e15ae35cf986ff0304988b67941e1fd6edf6a66fc39f98
SSDEEP

3072:MPC9YR7mIBMeqxObC0PKuUYfztR0+J80MlL:PYR7KWbzwYfztxqBlL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
35590dbaca9c44687428c49ebaa51a8a

Files

35590dbaca9c44687428c49ebaa51a8a
.exe windows:5 windows x86 arch:x86

1a9d3901e788d51c80edb5509daa6d20

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateSemaphoreA
GetStdHandle
GetVersionExA
CreateEventA
CreateMutexA
GetModuleHandleW
GetProcAddress
GetModuleHandleA
GetStartupInfoW

user32

LoadIconA
GetWindowDC
ReleaseDC
LoadCursorA
SetWindowTextA
LoadCursorFromFileA

shell32

SHSetLocalizedName

msi

ord212

msvcrt

_wcmdln
__dllonexit
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_exit
_XcptFilter
exit
_initterm
__wgetmainargs
_onexit

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 99KB - Virtual size: 180KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 544B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ