3a448f620fc6ea0adf7479d9527fed59 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3a448f620fc6ea0adf7479d9527fed59
Size

97KB
MD5

3a448f620fc6ea0adf7479d9527fed59
SHA1

0e9e013c1a2adfce1ef100af3492defc6c5206c7
SHA256

7dfb6430723ae13fd8c536e2babe353443273990bf5678f907c7386a8e5977e7
SHA512

4018f65e1fa65c8b80ebb02a67f50a00ce451ea3f8607438367bc7b02c37a955d05195def64b2e9c22d215ddf8a9f8a6dcbfced57a6b05dea487f55b80d3b948
SSDEEP

3072:fWkIidO9M57FNG95n2ThWsNexPnCrnS5n2ThWsNexPnCrnd:f1Zc3nkP+6bwnkP+6bd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3a448f620fc6ea0adf7479d9527fed59

Files

3a448f620fc6ea0adf7479d9527fed59
.exe windows:4 windows x86 arch:x86

d4591f7112a6de3b5d1519b0970e38d8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr80

__set_app_type
_crt_debugger_hook
_unlock
__dllonexit
_encode_pointer
_onexit
_decode_pointer
_except_handler4_common
_invoke_watson
_controlfp_s
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_lock
memset

kernel32

GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange
GetModuleHandleA
GetProcAddress
GetSystemTimeAsFileTime

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ