011d403b345672adc29846074e717865 | Triage

Sharing

General

Target

011d403b345672adc29846074e717865
Size

115KB
MD5

011d403b345672adc29846074e717865
SHA1

1048ccc8d1ac75a22376fc12cfd2b70d17b3da74
SHA256

3b78da1ee579d2c3a27d6b93189c1c2610cc8b78a98989eb9dc405f271274ee6
SHA512

afca685e8fc6343a8f1564db4c0174e14e16c01aaa02077fc83b8b89fdee299b68c35583356a0268fa5a3f6b262c101c8b0cc50e546290fe7d50bf9dcb4e239c
SSDEEP

3072:tFF/mvFL2zNSnoxEcAcHwo53Q91coyqcV:HF/uUycAcHwoo1E1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
011d403b345672adc29846074e717865

Files

011d403b345672adc29846074e717865
.exe windows:4 windows x86 arch:x86

cbf1d9643251f03c4850d1dd05e9feab

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalLock
GlobalAlloc
LocalAlloc
GetCommandLineA
GetVersion
VirtualAlloc
GetModuleFileNameA
ResetEvent
GetDriveTypeW
IsBadWritePtr
HeapDestroy
GetLocalTime
FreeEnvironmentStringsW
DeleteCriticalSection
GetStringTypeA
lstrcmpiW
UnmapViewOfFile

msvcrt

atoi
time
__winitenv
_acmdln
_initterm
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
_pctype
__setusermatherr
toupper
fputs
__p__fmode
_XcptFilter
_iob
exit
__initenv
strncmp
free
rand
__p__commode
__set_app_type
??2@YAPAXI@Z
wcscpy
_errno
printf
_stricmp
_adjust_fdiv
__mb_cur_max
_wcsicmp
memmove

Sections

.text
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ