1ec4a3de0c974080ef893ba7ae472fef | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1ec4a3de0c974080ef893ba7ae472fef
Size

8KB
MD5

1ec4a3de0c974080ef893ba7ae472fef
SHA1

af615d04f2df606a91e2241fc301ace141eec3ea
SHA256

291ccc67c018595b3ee972e79220583081059fe093aeee95f86204910408fecf
SHA512

af08d5137bc3983ef562693c5bbef4918cc04a9015f77a638f7ac51cd931efd518b3bef4b3d1ef98964c2125f64d6e08456658767e37b557622b36952fd9412f
SSDEEP

96:ZXL0Qum08ubJT/Kpt0LHdAeylaGaeLfrX+VIUr:ZXwQY8ubRDAe7zeLau

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1ec4a3de0c974080ef893ba7ae472fef

Files

1ec4a3de0c974080ef893ba7ae472fef
.exe windows:4 windows x86 arch:x86

40fd4e4d5dfc733f565b804379c74063

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
CreateFileA
CreateThread
CreateToolhelp32Snapshot
ExitProcess
GetCommandLineA
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
LoadLibraryA
Module32First
Module32Next
OpenProcess
ReadProcessMemory
RtlZeroMemory
WinExec
WriteFile
WriteProcessMemory
lstrcatA
lstrcmpA
lstrlenA

user32

wsprintfA
CharUpperA
CreateWindowExA
DefWindowProcA
DispatchMessageA
GetMessageA
GetWindowTextA
GetWindowThreadProcessId
LoadCursorA
LoadIconA
PostQuitMessage
RegisterClassExA
SetTimer
TranslateMessage

wininet

InternetOpenUrlA
InternetOpenA

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ