1d2979577bf6bf6817ae92b656325331 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1d2979577bf6bf6817ae92b656325331
Size

57KB
MD5

1d2979577bf6bf6817ae92b656325331
SHA1

749e84ffb3df675d25c03dd3c5e2c63ac3dad811
SHA256

3c193e89236aa50907191a4b0c6e0b3aee1f53549afa9e3d88ab64b1d7083df2
SHA512

e5836aa6b85feadcb89e97d679e2a915a4527c8f537fd04f2669ed7bdf1d54a4aef52431d532fbc2519fb60c23ca8f42dcf1f1a68921d724c9b4f0d70653b84f
SSDEEP

768:W+/4lZP/TT4YI8aMu5ku/U5CnU9EcpqYVTbEMOI5hD+6O42gVKNi+90YDt:P4H8YCeuMMUD8YlbEYq6Vms+9ZDt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1d2979577bf6bf6817ae92b656325331

Files

1d2979577bf6bf6817ae92b656325331
.exe windows:4 windows x86 arch:x86

a3cfb2b1d332f0a434ad0c10452f6389

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

CryptGetKeyParam
CryptSetKeyParam
DeregisterEventSource
GetMultipleTrusteeA
GetSidSubAuthority
IsTextUnicode
ObjectDeleteAuditAlarmA
RegDeleteValueA
RegSaveKeyA

kernel32

CreateFiber

user32

ArrangeIconicWindows
CharLowerBuffA
DrawCaption
GetMessagePos
MapVirtualKeyExA
PackDDElParam
RedrawWindow
SendIMEMessageExA
SetCaretBlinkTime
ShowCursor
UnhookWinEvent

Sections

.wjwbu
Size: 22KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.qzo
Size: 5KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.dap
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ibkze
Size: 25KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ