01674e257eb56af10cd2fc585a367eff | Triage

Sharing

Copy URL Twitter E-mail

General

Target

01674e257eb56af10cd2fc585a367eff
Size

134KB
MD5

01674e257eb56af10cd2fc585a367eff
SHA1

51e2e774e382fac897491ec0c4087e8ec67d33ea
SHA256

02883ab17a2f479f718ed89fe8b12fa389c9397560c0d3d4e3ae3fcb7623aec2
SHA512

e25dd33fd9adaa0c0a24758ccbeca7805cf8ab2b188c544fd321f97b7305233add03f84adbdc6288fb03d562b6ff576911a0a3807badfbef9890558e6b880dde
SSDEEP

1536:BHHIYpEAyW0CzBiBXJMiOTygeoasc4F/EXCRHdGvv8TRJ6m+drZ:RdpPliPMi9FtrCRiv2J6m+H

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
01674e257eb56af10cd2fc585a367eff

Files

01674e257eb56af10cd2fc585a367eff
.exe windows:4 windows x86 arch:x86

71411def9c77f166cb46b28a8e8b33c4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

InitCommonControls
CreateStatusWindowA

user32

SetTimer
SendMessageA
RegisterClassExA
PostQuitMessage
MessageBoxA
LoadIconA
TranslateMessage
KillTimer
GetMessageA
GetCursorPos
DispatchMessageA
DefWindowProcA
CreateWindowExA
LoadCursorA

kernel32

lstrcatA
WriteProcessMemory
VirtualAllocEx
Sleep
SizeofResource
SetThreadContext
RtlZeroMemory
ResumeThread
LockResource
LoadResource
CreateProcessA
ExitProcess
FindResourceA
GetModuleFileNameA
GetModuleHandleA
GetThreadContext

ntdll

ZwUnmapViewOfSection

Sections

.text
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 1010B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE