fa625d21073f0e04105a3637e2a37e20 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fa625d21073f0e04105a3637e2a37e20
Size

611KB
MD5

fa625d21073f0e04105a3637e2a37e20
SHA1

530471175bc39da403518634a087502840d56ccb
SHA256

e6381bc25ca13cf8fb32345fa28cf396911d9aaa3a2abb2ded735971c1f342a5
SHA512

5824170b27e497aecf1f9aee55521ea4a8982c0ff98b209c866360351295cb134a47cf87d94f5e77c5474c11c6b94158105cdbc0040819da9f6b91632cd05ea5
SSDEEP

12288:XEQKcvd1rskhITHNya7JYNLuny/Tf4G2MNcA/BxyzUlmpCXq:05edJhhITtbtYJun0EG2LA/yzUl9Xq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fa625d21073f0e04105a3637e2a37e20

Files

fa625d21073f0e04105a3637e2a37e20
.exe windows:4 windows x86 arch:x86

74c8bf4a938fcfd1da0d91e7d39ead48

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

oleaut32

SysFreeString

advapi32

RegSetValueExA

gdi32

StretchDIBits

user32

WaitMessage

shell32

ShellExecuteExA

ole32

OleInitialize

winmm

timeKillEvent

comctl32

ImageList_Draw

cabinet

FDIDestroy

Sections

CODE
Size: 40KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE