203f036f1e8d39794019e848238c79c6 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

203f036f1e8d39794019e848238c79c6
Size

72KB
MD5

203f036f1e8d39794019e848238c79c6
SHA1

93d4d820fb2c6dc3a3e51f130d458f675955497e
SHA256

de2b1e9939228b6c40eeea2597cd2ec5305d2fd5c02704b89c212d0798a81a3d
SHA512

cb4f12c5fae604b24242ac9191f2ff185295461ed4a5b2326d47f08fc9f5c5eac5ec78411375d6993891f28884fdabe32787e27b3c4f6b8d3e4a79a5f72f9d97
SSDEEP

1536:TqtZ/e5y3Q1SDpXlGXGvmLJXFGTcZotCpA:TqtJe5ZorvmLJXFGTztCpA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
203f036f1e8d39794019e848238c79c6

Files

203f036f1e8d39794019e848238c79c6
.exe windows:4 windows x86 arch:x86

ac965a0fe9ee27303dfaf6c63b4e5ebd

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapAlloc
GetProcessHeap
LoadLibraryA
GetProcAddress
SetLastError
FreeLibrary
GetVersionExA
HeapFree
GetLastError
lstrlenA
lstrcatA
GetCurrentThread
GetCurrentProcess
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleA
TlsGetValue
TlsSetValue
GetCurrentThreadId
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
LeaveCriticalSection
EnterCriticalSection
ExitProcess
Sleep
GetLocaleInfoA
InitializeCriticalSection
WriteFile
GetStdHandle
GetModuleFileNameA
VirtualFree
VirtualAlloc
HeapReAlloc
RtlUnwind
RaiseException

user32

wsprintfA

Sections

.text
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ