f644c488140c6f97661479d2667d4881 | Triage

Sharing

General

Target

f644c488140c6f97661479d2667d4881
Size

279KB
MD5

f644c488140c6f97661479d2667d4881
SHA1

b02c6f83fdcd0cc660ac4809061a264e30128f72
SHA256

dc6c3fe5b262e3ab7663faa1704c7c8145fdc5d531fce6fed7fa116b61c8e7f2
SHA512

6522d4cb1531e13cc4a675186925590344ab8b8621628c2436e448fa7102734558b82ce7b3c72378e84d7050c0e53780e4791b408d84a6b18a98c0cfece7af69
SSDEEP

6144:KG9MKZWfNTnhQWnWREJ7kwMA+dK1pEFBdRB7o:K6MBNTtnWEVO9kTETf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f644c488140c6f97661479d2667d4881

Files

f644c488140c6f97661479d2667d4881
.exe windows:4 windows x86 arch:x86

e2c89d25224b7def2f2a8ad68c30341e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RtlUnwind
HeapAlloc
GlobalAddAtomA
ExitProcess
SetEndOfFile
VirtualProtect
GetCurrentProcess
SetFilePointer
VirtualQuery
WriteFile
EnumResourceNamesW
HeapFree
GetSystemInfo
GetVolumeInformationA
FlushFileBuffers
GetOEMCP
ReadFile
FindAtomW

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

setupapi

CM_Get_Depth
CMP_WaitNoPendingInstallEvents
SetupDiGetDeviceRegistryPropertyW
CM_Get_DevNode_Status

comdlg32

ChooseFontA
GetOpenFileNameA

ole32

CLSIDFromString
CoTaskMemFree
CoCreateInstance
StgCreateDocfile

Sections

.text
Size: 147KB - Virtual size: 278KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 129KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ