4f5817d3e62a3efad3371e4692ee8132 | Triage

Sharing

General

Target

4f5817d3e62a3efad3371e4692ee8132
Size

184KB
MD5

4f5817d3e62a3efad3371e4692ee8132
SHA1

74f2e7ecd41ccf9cdf286d7f18972fa0b0d8981c
SHA256

32f5ad135e845ec7ee3bc1938867b39fef757905317d3e11b4020b05db6229e5
SHA512

fa86e6c93673c6d2ca4723278db7224ddfba40c98f63ad1d7824968138d0e355612fcb6189f556127978c1429f4e6f86838dab654fc5495abb374c8ba825a0af
SSDEEP

3072:f3VTr1M915kcKtkro2sE08LG19TqDAPcsHi/VSMsM5eMYYZ21lZSwnZ6iG:jMDWJtk1sE0X/u6e/ITMk3s

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4f5817d3e62a3efad3371e4692ee8132

Files

4f5817d3e62a3efad3371e4692ee8132
.exe windows:5 windows x86 arch:x86

f717fd47764a7e34b63681a25b93899e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

PolyDraw
ArcTo

kernel32

GetModuleHandleA
GetProcAddress
InterlockedExchange
SetUnhandledExceptionFilter
Sleep
TerminateProcess
UnhandledExceptionFilter
GetCurrentProcessId
VirtualFree
VirtualProtect
lstrlenW
ExitProcess
FindFirstFileW
FindNextFileW
VirtualAlloc

msvcrt

_initterm
_ismbblead
_wcsdup
_wcslwr
exit
free
memset
printf
wcsstr
wprintf
_exit
_controlfp
_cexit
__setusermatherr
__set_app_type
__p__fmode
__p__commode
__getmainargs
_XcptFilter
_amsg_exit

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

shell32

SHGetSpecialFolderLocation
CommandLineToArgvW
SHCreateDirectoryExW

user32

IsWindow

Exports

Exports

Compact
FInitializeRichEdit
FIsSpaceA
IsDigit
IsUpper
ProcessBatch

Sections

.text
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 106KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 447B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ