4bab8d0afdde4c194bb52c0ca756e190 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4bab8d0afdde4c194bb52c0ca756e190
Size

403KB
MD5

4bab8d0afdde4c194bb52c0ca756e190
SHA1

28c283a9c0b0b0a78eb18f06e53ae20917f7ed13
SHA256

d48253d8e299fd8615c1d0123edbcee3dabc1696b23c10c605af89f949e950e3
SHA512

a671f8e37cf7607cc1dacdd8a7edef4c02504fdc537ed1b7ffe5c35ce443595eb5acbfdfbbda37a2d2d2470bffeeb85348a82c021eae197e10244a236b7e49f0
SSDEEP

6144:FIx9jAYvRjc6PXG+2um+4hLfnexFgrdnCBzd2Z4E3Nrb28fNOYR0XYTBoXZ2RSE/:FIgQRjBPSlmxFYC3QXhDFOqTOXZQSE/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4bab8d0afdde4c194bb52c0ca756e190

Files

4bab8d0afdde4c194bb52c0ca756e190
.exe windows:4 windows x86 arch:x86

fd6fa3a8acc18ea8cef15b6bbe64c2d5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

oleaut32

SysFreeString

advapi32

SetSecurityInfo

shell32

Shell_NotifyIconA

msacm32

acmFormatChooseA

version

VerQueryValueA

winmm

waveOutWrite

mpr

WNetOpenEnumA

avicap32

capCreateCaptureWindowA

user32

CreateWindowExA

gdi32

UnrealizeObject

wininet

InternetReadFile

wsock32

WSACleanup

comctl32

ImageList_SetIconSize

ws2_32

WSAIoctl

Sections

CODE
Size: 390KB - Virtual size: 872KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

love
Size: 36B - Virtual size: 50B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE