39036f0af20b42ef6bd824ae8613aa81 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

39036f0af20b42ef6bd824ae8613aa81
Size

13KB
MD5

39036f0af20b42ef6bd824ae8613aa81
SHA1

8a194e3f5662c4f146425728ece4d25b2fb6dc93
SHA256

53bf8fe22c6770743d5518526f5e71e10d29213a0010f66dee2a4459498dd770
SHA512

fe0a34be1cb9166af54bad5b5ef9e67330c1624438445990e46ca385cd8eed6e94f899ae935a3432b382ecdfee59a1ac14ec002b7dc01a5e1a3ec3e871b95e62
SSDEEP

192:cRlVZM++KetauWQeuYGRmqfqjZIWP0CAxMVkMshhoq1i9bR8t6:wVZM++KeC3TGR4iWPg+VpUhM9byt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
39036f0af20b42ef6bd824ae8613aa81

Files

39036f0af20b42ef6bd824ae8613aa81
.exe .vbs windows:4 windows x86 arch:x86 polyglot

39ac9abb686db084ce0d2fea15b27467

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memmove
strncpy
??3@YAXPAX@Z
??2@YAPAXI@Z

comctl32

ord17

kernel32

GetVersionExA
HeapReAlloc
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapFree
IsBadReadPtr
MultiByteToWideChar
WideCharToMultiByte

user32

MessageBoxA
wsprintfA

ole32

CLSIDFromProgID
CoUninitialize
CoInitialize
OleRun
CLSIDFromString
CoCreateInstance

oleaut32

VariantChangeType
VariantInit
SafeArrayDestroy
VariantClear
SysAllocString
SafeArrayCreate
RegisterTypeLi
LoadTypeLi
VarR8FromBool
VarR8FromCy
SafeArrayGetElement

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE