70cbf92de803bb18c8c8c57377e151f6 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

70cbf92de803bb18c8c8c57377e151f6
Size

209KB
MD5

70cbf92de803bb18c8c8c57377e151f6
SHA1

789d3383b8a47f8be9cd05f79777e43973de4a30
SHA256

dab3c3abdfaa6dc2d459dcd33cd473db91a866c46a94161650521302c1a05cf7
SHA512

7dcbf206cbb489992be315d50537ffbc01a49b3a02a3ec92bce8edbe30d2d5eb3fb3da03ec76aca8d17e030207909e7011f2e02c5c7021318c6e7d7536d7f717
SSDEEP

6144:xli5SX3/lN687qqCu1xqU90+2BazFJ5oBIgLKdfWA:bJ7vy60+JaduW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
70cbf92de803bb18c8c8c57377e151f6

Files

70cbf92de803bb18c8c8c57377e151f6
.exe windows:4 windows x86 arch:x86

691f1193f16065947032ace3a2329e55

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

msvcrt

fabs

comctl32

InitCommonControls

user32

IsChild

gdi32

BitBlt

ole32

CoInitialize

shell32

ShellExecuteExA

shlwapi

PathQuoteSpacesA

Sections

.MPRESS1
Size: 204KB - Virtual size: 752KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE