004814e33867073bd90a9d96f1efeef7 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

004814e33867073bd90a9d96f1efeef7
Size

8KB
MD5

004814e33867073bd90a9d96f1efeef7
SHA1

68c570e3cd69b8c9e98d5dddde036ff0a831cc4d
SHA256

53954d8913f8f5a6560bb123912bc62a9f5d93a679a78e454703d389a978b61f
SHA512

dd7b18357c7c8148d0af1e7e1cc72a69a571048a8992dcb349423aecf34586050c535cfeefcc1d3722c1b53785a3b377f84e7cdb40b7ee3cd66fcbf0373d4426
SSDEEP

96:XM0EvBdJan3rITk0KG4WXdAeylHGaebN2Vrk:XMd0U14QAeezebw+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
004814e33867073bd90a9d96f1efeef7

Files

004814e33867073bd90a9d96f1efeef7
.exe windows:4 windows x86 arch:x86

e569dab882f11190c0fd9f03eab05f80

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
CreateFileA
CreateThread
CreateToolhelp32Snapshot
ExitProcess
GetCommandLineA
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
LoadLibraryA
Module32First
Module32Next
MoveFileA
OpenProcess
ReadProcessMemory
RtlZeroMemory
WinExec
WriteFile
WriteProcessMemory
lstrcatA
lstrcmpA
lstrlenA

user32

wsprintfA
CharUpperA
CreateWindowExA
DefWindowProcA
DispatchMessageA
GetMessageA
GetWindowTextA
GetWindowThreadProcessId
LoadCursorA
LoadIconA
PostQuitMessage
RegisterClassExA
SetTimer
TranslateMessage

wininet

InternetOpenUrlA
InternetOpenA

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ