0b868e38a02835f476467f0559d832a8 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0b868e38a02835f476467f0559d832a8
Size

111KB
MD5

0b868e38a02835f476467f0559d832a8
SHA1

cbe3b957158aa12e69587cbf87e5f396bd7a4883
SHA256

6195fc4aaea6e3bcadcad7ba440c788b46bb1562e0b8038b1dba801be9853d0e
SHA512

7d52fdc07f24c8d899930ddc8d285650b4a1cfac5bd9cc861758a2343008ba9c1a96c9e53d9b8816aa8e04981204fc6ac0ba74f337f74ca76c62e13985acef30
SSDEEP

3072:Xfgpvv1sfv72RmfSl02zsHZzQF4cGXarJ:XYvv1skms02zs5zQucGX+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0b868e38a02835f476467f0559d832a8

Files

0b868e38a02835f476467f0559d832a8
.exe windows:4 windows x86 arch:x86

e60890c77bc35ae7e766cf1e2cc3c59f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

MenuHelp
PropertySheetA
ImageList_Merge
ImageList_SetBkColor
ImageList_Duplicate
ImageList_Merge

user32

ChildWindowFromPointEx
CopyImage
CreateAcceleratorTableA
DdeAccessData

comdlg32

ChooseColorA
ChooseFontA
PrintDlgA
GetFileTitleA
GetOpenFileNameA
dwLBSubclass

shell32

ILFree
SHLockShared
SHIsFileAvailableOffline
SHGetShellStyleHInstance

Sections

.text
Size: 63KB - Virtual size: 90KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 19KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE