694bee946ed34b1ba426d9cbd20f1ad5 | Triage

Sharing

General

Target

694bee946ed34b1ba426d9cbd20f1ad5
Size

54KB
MD5

694bee946ed34b1ba426d9cbd20f1ad5
SHA1

960e7176f3311bfb921c8b48c6598a129aa83905
SHA256

eaf7f2337fd37afb1315b03a94ddabe47f960547e08df0f4698ba556a815d41f
SHA512

d200e5fe7d3cb2e8c69e25e52611980171bc51574eeb12d377990c99db0a5ad4f62d34470906e52479fd35c811dd04df5086c75b743f2e11c9b156ccc4f33e19
SSDEEP

768:ldPrFwRYFapYstQQ2kDDIiJgLhHtR1krnGOVZWnrtvUsonlJVoJa9b1nY:ltFw9tQQ2krgLdt8jKrtvUsUJoJM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
694bee946ed34b1ba426d9cbd20f1ad5

Files

694bee946ed34b1ba426d9cbd20f1ad5
.exe windows:4 windows x86 arch:x86

2cafde029a8d9f434d4f7682edd49de7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

LoadIconA
GetMessageA
TranslateMessage
SetWindowsHookExA
RegisterClassExA
PostQuitMessage
FindWindowA
DispatchMessageA
DefWindowProcA
CreateWindowExA
MessageBoxA
LoadCursorA

kernel32

Sleep
_lcreat
_llseek
GetSystemDirectoryA
LoadLibraryA
GetModuleHandleA
GetProcAddress
lstrcpyA
lstrcmpiA
CloseHandle
CopyFileA
CreateThread
ExitProcess
FreeLibrary
GetCommandLineA
GetCurrentDirectoryA
GetCurrentProcessId
GetModuleFileNameA
_lwrite
lstrcatA
_lclose
SetCurrentDirectoryA
_lread
_lopen

advapi32

RegSetValueExA
RegCreateKeyA
RegCloseKey

wininet

InternetGetConnectedState

wsock32

gethostbyname
connect
closesocket
htons
send
socket
WSAStartup
recv

shell32

ShellExecuteA

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 29KB - Virtual size: 328KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE