20af2ac2ba0f07b3ae160fc309f0e938 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

20af2ac2ba0f07b3ae160fc309f0e938
Size

343KB
MD5

20af2ac2ba0f07b3ae160fc309f0e938
SHA1

c14bf4f48af46dc152d561f38a91278ec7639456
SHA256

7a6cd2d30f07a7bedac157aa749ee47d73485c8f17f4723310d610cceb30368a
SHA512

a1962484af1d1b80669e413e4480cf3fd381312834985b7c177ed849e1e9fad2f2f686c3329dc82ac607c510796ed7a8a468dd3a1993886f8e97a8e85e083fc3
SSDEEP

6144:1K3enn8Op9Ev/O7vS2TC6tGXo8d52qh3767IYa0EI3N2WfEjI75nuWDQb0Q:s3TOLCy62T5tUo8d5TL/0EI3N7fn5nPq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
20af2ac2ba0f07b3ae160fc309f0e938

Files

20af2ac2ba0f07b3ae160fc309f0e938
.exe windows:5 windows x86 arch:x86

e57fc6312ca3ab50d2df0dc1e0e64207

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

wsock32

__WSAFDIsSet

version

VerQueryValueW

winmm

timeGetTime

comctl32

ImageList_Remove

mpr

WNetGetConnectionW

wininet

FtpOpenFileW

psapi

EnumProcesses

userenv

LoadUserProfileW

user32

GetDC

gdi32

LineTo

comdlg32

GetSaveFileNameW

advapi32

GetAce

shell32

DragFinish

ole32

CoInitialize

oleaut32

SafeArrayAllocData

Sections

.MPRESS1
Size: 242KB - Virtual size: 788KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE