6a66621038a949d4eca6662baeb2e006 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6a66621038a949d4eca6662baeb2e006
Size

1.7MB
MD5

6a66621038a949d4eca6662baeb2e006
SHA1

6d26667707b64e8b56aa9c270112a2915175ef06
SHA256

e9609bb039b6f47531d7b9633f4a7e69de14cf23d6ad6e9966f68b1493380f74
SHA512

87eecc4afc1da9d952dc80fbd2bcd08d143ce8b85c0fe3df76a811417c27cc788d9ffd2e3da16ecc908ca2871d4f4fd7450278d68c652f0c662214cfd6317290
SSDEEP

49152:zoCiyanwRshJbm6yLWk4gxngzvOQ8pghW6A:KdnashJbCWk9xiYmA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6a66621038a949d4eca6662baeb2e006

Files

6a66621038a949d4eca6662baeb2e006
.exe windows:4 windows x86 arch:x86

c931d2693529c6171aad91b4dfe0c3b3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

setupapi

CM_Get_Depth
SetupDiGetDeviceRegistryPropertyW
CMP_WaitNoPendingInstallEvents
CM_Get_DevNode_Status

kernel32

GlobalAddAtomW
GetOEMCP
VirtualProtect
WriteFile
FlushFileBuffers
GetCurrentProcess
ReadFile
HeapFree
GetSystemInfo
EnumResourceNamesW
SetFilePointer
GetStringTypeExW
VirtualQuery
HeapAlloc
SetEndOfFile
RtlUnwind
ExitProcess
FindAtomW

comdlg32

ChooseFontA
GetOpenFileNameA

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

ole32

CLSIDFromString
CoTaskMemFree
CoCreateInstance
StgCreateDocfile

Sections

.text
Size: 873KB - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 855KB - Virtual size: 855KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ