3a41a38cfecd4fb6c7cc0bf4b7a351e8 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3a41a38cfecd4fb6c7cc0bf4b7a351e8
Size

3.3MB
MD5

3a41a38cfecd4fb6c7cc0bf4b7a351e8
SHA1

7e3a2436e32cead9926d158aaa7e32728876efa9
SHA256

04968ba3356cee5d9deefc9cf6b6ef323e58555ce2fbf42022107e3c4b346d99
SHA512

ea0fcb41f178aede7bda95de0ca0318e24aa254a8e66c600a70efcb989bfe9949e85a0d7fdebdac98abde2782fe63106c3f15e7e99e341b10973a33081ceaeff
SSDEEP

98304:ZVMcrV+s4IHiGA87L2PiiYpLOTaoKR2dAkR1Q8UxusRx:DMfpc7L2iiYBo2wSks8UpRx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3a41a38cfecd4fb6c7cc0bf4b7a351e8

Files

3a41a38cfecd4fb6c7cc0bf4b7a351e8
.exe windows:5 windows x86 arch:x86

6469d4ff61d84a64e0cd4bc501f1b70a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersion
GetVersionExA
GetVersionExW
GetFileType
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

SetProcessWindowStation

Sections

.text
Size: - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 288KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata0
Size: - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata1
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 239KB - Virtual size: 239KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ