04980596d66951166fa2ebfd96c84d22 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

04980596d66951166fa2ebfd96c84d22
Size

164KB
MD5

04980596d66951166fa2ebfd96c84d22
SHA1

76581a6c5ed49c8c0567c6f6ef9788aa61fe7347
SHA256

1395a50888b4c73f21c6b5a00af040111af037ec72d49bf6d18609d053be2f82
SHA512

7c78d1ab9320d1ae4d7cfc39f6e324e1a0b0016fddeeb56ccd83d668f5fc27afbbca5f9874072d362343a64279c108c953a9fa1f7ebc4790df177a0a02c46eb6
SSDEEP

3072:WXmxKcYFvjNwx7yCYOOOOOIOOOMTYOOOOOIOOOPUUYYUYUYUYUYUYUUYUYUYUYOn:uOcKGglq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
04980596d66951166fa2ebfd96c84d22

Files

04980596d66951166fa2ebfd96c84d22
.exe windows:6 windows x86 arch:x86

1f83362a57e6d6a2f15132c167d7f42c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WriteFile
FileTimeToSystemTime
VirtualAlloc
VirtualProtect
GetFileInformationByHandle

mpr

WNetUseConnectionA
WNetCancelConnection2W
WNetGetLastErrorA
WNetAddConnection3W
WNetGetUniversalNameA

winspool.drv

EnumMonitorsW
ord215
GetPrintProcessorDirectoryA
FindNextPrinterChangeNotification
EnumPortsA
GetJobW
AddPortA

gdi32

ExtEscape
Escape
SetMapperFlags

msi

ord116
ord41
ord22

user32

MessageBoxW

Sections

.text
Size: 512B - Virtual size: 210B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 159KB - Virtual size: 158KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ