61e9eda6fd57f9a467c8785137ff9dbe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

61e9eda6fd57f9a467c8785137ff9dbe
Size

329KB
MD5

61e9eda6fd57f9a467c8785137ff9dbe
SHA1

ead0bf0e1c6d4fa5688fe319b0b84deec68dbdac
SHA256

dd5cf728404f4c60f7dd5f62b582affe200bd3eba812bfba6c354f21cd2023f4
SHA512

59a01c892d32b69108c5be43c52e4ed8768c8be8d789510d3e63b15153bd54cc0ad75a3a1f2ad3c77d5f432b4e0e26b0bb819f2a3c289031cda0911294fadbf6
SSDEEP

6144:Sj7U4p7bZX+m9Y0yQirofhSALlYfCkgn3/U6CZsS4B4WSOvARapZM:K7UA9X+IhPvvohWxARgO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
61e9eda6fd57f9a467c8785137ff9dbe

Files

61e9eda6fd57f9a467c8785137ff9dbe
.exe windows:4 windows x86 arch:x86

4a5c00106baf19434f680ed19c0258ad

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrlenA
WaitForSingleObject
CloseHandle
GetVersion
GetSystemDefaultLangID
GetAtomNameA
LoadLibraryExA
VirtualProtect
CompareFileTime
GetConsoleDisplayMode
InterlockedExchange
GlobalUnlock
GetTickCount
GetCommandLineA
LocalSize
GetConsoleCP
HeapReAlloc
GetModuleHandleA
SuspendThread
HeapCreate
WaitForMultipleObjects

gdi32

Escape
GetTextColor
EngLineTo
BeginPath
Ellipse
GetMetaRgn
DeleteDC
GetMetaFileA
EqualRgn
DeleteObject
AbortPath
FloodFill
EndPath
CreateFontA
GetRgnBox
CreateICA
GetStringBitmapA
GetFontData
CreatePalette

rastapi

DeviceConnect
DeviceListen
DeviceDone
PortClose
AddPorts

dhcpsapi

DhcpAddServer

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 744KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ