69164f352de853b784fa6c30f22f0e4e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

69164f352de853b784fa6c30f22f0e4e
Size

190KB
MD5

69164f352de853b784fa6c30f22f0e4e
SHA1

3b5e2abf41823d09b28b7d1787c672c39f3b9868
SHA256

e7df31ad4d781db822864c006acfc950b3ddb22a576c1514fc8d326bfbc65c51
SHA512

3a6ed1626c315823c612b88180f8d973f651e264107c3a5bd871a80401252c5cb3459205334c1ca90c1be79585c7b46f628de04af49ef806262d0e7b952b8f37
SSDEEP

3072:gM2gzENCUmCJYYMJAmz0IAC2gUEUf5qrLtFJ4MyVnoJ18I92UASeakkfFJPAO1+V:WyegczMJWI6gPGqrLt74MKoD8IPb3A2Q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
69164f352de853b784fa6c30f22f0e4e

Files

69164f352de853b784fa6c30f22f0e4e
.exe windows:4 windows x86 arch:x86

f0afcb9fdd4e9e041bf590535a69e147

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

SetTapePosition
GetVersion
ClearCommError
InterlockedExchange
GetCurrentProcessId
GetWindowsDirectoryA
EnumResourceNamesA
GetLocalTime
FatalExit
FindClose
Sleep
FindFirstFileA

user32

ReleaseCapture
GetDlgItem
GetSysColor
SetWindowLongA
FillRect
LoadCursorA
IsWindow
SetCursor
GetWindowLongA
SetWindowPos
ReleaseDC
GetWindowInfo
MoveWindow
GetDC
SetCapture

shell32

SHGetMalloc
SHGetPathFromIDListA
SHGetSpecialFolderLocation

ole32

ProgIDFromCLSID
CoTaskMemFree
StringFromCLSID

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

oleacc

LresultFromObject
CreateStdAccessibleObject

winmm

mciSendCommandA
sndPlaySoundA

Sections

.text
Size: 166KB - Virtual size: 165KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.lib
Size: 512B - Virtual size: 352KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ