0bb9549b0e59060f381fc84482d582fd | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0bb9549b0e59060f381fc84482d582fd
Size

392KB
MD5

0bb9549b0e59060f381fc84482d582fd
SHA1

62b7a4f65c773b9e7ce247014321a2df2e9a2750
SHA256

57945b91639d9dc9125d49eed5bc28291946f110697198a21842b524c6b396e1
SHA512

3f824dac40a675a907782d53655cebdbc78df8e8b9f040eae1045114ebdff624c3e0b4a660a15100c91a44f8b7f89696bb66efd35637521e7072a765b1421ac8
SSDEEP

6144:EAnWsfMZaRW678WnhZcJaCD1OvkafeeNcbc9e2sCMwi+IzFMfAmLs8kNjb2SS43a:EAnWOGb6VTcvDgkgee19esftUx2xQa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0bb9549b0e59060f381fc84482d582fd

Files

0bb9549b0e59060f381fc84482d582fd
.exe windows:4 windows x86 arch:x86

be55eb9fa43ad1cb32206b62aefeb38b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcessId
VirtualQuery
LoadLibraryA
GetSystemDefaultLangID
RtlUnwind
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcess
GetProcAddress
VirtualAlloc
GetCurrentThreadId
VirtualAllocEx
HeapReAlloc
HeapAlloc
SetFileAttributesW
GetSystemTimeAsFileTime
HeapFree
InterlockedExchange
GetModuleFileNameA
TerminateProcess
GetModuleHandleA
ExitProcess
GetTickCount
CreateFileA

comdlg32

ChooseColorA
GetFileTitleA
ChooseColorW
FindTextW
ChooseFontA
PrintDlgW
GetFileTitleW
GetOpenFileNameW

wininet

InternetReadFile
InternetCombineUrlA
FtpGetFileA
FindFirstUrlCacheContainerA
InternetGoOnlineW
InternetFortezzaCommand
GopherFindFirstFileW
FindNextUrlCacheEntryA
FtpDeleteFileW
GetUrlCacheConfigInfoA
InternetAutodialHangup

Sections

.text
Size: 117KB - Virtual size: 117KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 264KB - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ