003ef64b821f9383be36c7f2198afa93 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

003ef64b821f9383be36c7f2198afa93
Size

162KB
MD5

003ef64b821f9383be36c7f2198afa93
SHA1

9ab6aff0bf2e277ddac7b76c8e049d20373497c3
SHA256

8be1bc9856e49d314841e2fd5bd2c9906f62f5b2febd7ffc91583f17fd548749
SHA512

b6dcbf06c35fc8b2bea30c0785a05db42da2114afd5d5aa578ede84ed1d1c75cb3e08709f0be450d3ffc8ef7468dd803361dcb788ce2b4beaac92046c79fcdfc
SSDEEP

3072:MAy4PivmwIX2lrE5HkxWCfWrKPI1Vn5bRNAZykLYoYPlG8c+9k99Ogr:M14Piv6Gp5xW//1/bjqnEp8EaTVr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
003ef64b821f9383be36c7f2198afa93

Files

003ef64b821f9383be36c7f2198afa93
.exe windows:4 windows x86 arch:x86

16da28a7c245bd2c5422c8b8633df1f1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

winmm

PlaySoundA

vulanhookpro

VulanHookDll

user32

CharNextA

gdi32

SetMapMode

comdlg32

GetSaveFileNameA

winspool.drv

ClosePrinter

advapi32

LookupPrivilegeValueA

shell32

Shell_NotifyIconA

comctl32

ord17

oledlg

ord8

ole32

CoRegisterMessageFilter

olepro32

ord253

oleaut32

SysStringLen

wsock32

WSAStartup

Sections

.text
Size: 148KB - Virtual size: 432KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE