09796a1846080e4c7867f2d352437c6d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

09796a1846080e4c7867f2d352437c6d
Size

3.3MB
MD5

09796a1846080e4c7867f2d352437c6d
SHA1

11a87f73d33586372fb26f214e9919602c6dfbef
SHA256

409def767299546f9852b10ffc53a66801b50bb79c2bee794c641c84a40daf05
SHA512

d0364b5a4930325cc6f1a3066f4540c7c9d8196e26ca70d33c8144da2d29d5e27caf8c055e8cc536fee59af4eaca5b27986dd6fa563c88a3b9828af05b0e3293
SSDEEP

49152:3H0hV5eY/KbKWZpUrT+V2v/dcp5iAe6feFFYXwlkhuF2xn7FAJfKKOrKP64+:3U4cKZpUXTdWFX+ksFQhKdX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
09796a1846080e4c7867f2d352437c6d

Files

09796a1846080e4c7867f2d352437c6d
.exe windows:4 windows x86 arch:x86

cc2f58f251da1957c9ed90c5c7e17218

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetModuleHandleA
GetProcAddress

user32

CharNextA

advapi32

RegCloseKey

oleaut32

SysFreeString

version

VerQueryValueA

gdi32

SaveDC

ole32

OleDraw

comctl32

ImageList_Add

wininet

InternetGetConnectedState

Sections

.MPRESS1
Size: 3.3MB - Virtual size: 13.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE