1d8b1fade77e39071eb895787aced55c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1d8b1fade77e39071eb895787aced55c
Size

67KB
MD5

1d8b1fade77e39071eb895787aced55c
SHA1

510d55df06458409c6a443649726e2b57e950b33
SHA256

e60a14600ac7f1fd80efa55cb552ee36bf7166fff7661fa41c7e6694fa752af5
SHA512

29093dcdeb308355d0c30d14454a606c9786387b6f49348a8bb4b4d824e7aa693a487093dd4fd6c50d56c8a7190bbe77b18961d514964e4ec234a7029ada6fef
SSDEEP

1536:WSwWg3IW61hUmB1Tj8vhEM3FZLe+a3EKbU:W/WE5GOm7EnFZK+4bU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1d8b1fade77e39071eb895787aced55c

Files

1d8b1fade77e39071eb895787aced55c
.exe windows:4 windows x86 arch:x86

0539f1eebe638559781466b6fa1c50b8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

CallWindowProcW
MoveWindow
ReleaseCapture
SetRect
SetWindowsHookExW
GetActiveWindow
SetDlgItemTextA
DestroyIcon

kernel32

DeleteCriticalSection
GlobalUnlock
SetCurrentDirectoryA
HeapAlloc
lstrcmpW
IsValidLocale
GetLocaleInfoA
VirtualProtect
HeapFree
Sleep
CreateProcessW
SetUnhandledExceptionFilter
InitializeCriticalSection
InterlockedCompareExchange
GetCurrentThreadId
GetProcessHeap
ExitProcess
FreeEnvironmentStringsA
SystemTimeToFileTime
SetStdHandle
QueryPerformanceCounter
GetACP
GetOEMCP
SetConsoleCP
LeaveCriticalSection
GetModuleHandleA
GetStartupInfoA
GetTickCount

gdi32

CreateSolidBrush

ole32

CoTaskMemFree

advapi32

GetTokenInformation

msvcrt

fclose
strncmp

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 53KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ