0e55921d4382654f704ecd28fa62a904 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0e55921d4382654f704ecd28fa62a904
Size

77KB
MD5

0e55921d4382654f704ecd28fa62a904
SHA1

eff970c33b721a8e77c4aaa10e899ce8b052471e
SHA256

d916dde362e9bae12b09787595ff4b13cf47d5a9cd590940bc5aea1412662e08
SHA512

f44828b1bfb57cccb7473032526d6d59866253e3559596a7158f2b2fd57977336a4fe16471a4b254985b10f6d7a0c85fbbd30e30d0048c89efc505548d862651
SSDEEP

1536:8HHPVS5ZewJAbwiup1a+EYNDbe2ckbZfKEyveaxJHr1:8PMSw+y+YNDbe2DbCves

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0e55921d4382654f704ecd28fa62a904

Files

0e55921d4382654f704ecd28fa62a904
.exe windows:4 windows x86 arch:x86

31a29c11c09426dbc1c1bf2cd6557c1c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memcmp
strstr
memcpy

user32

GetActiveWindow
DrawIcon
DestroyCaret
FillRect
GetMonitorInfoW
GetShellWindow

advapi32

ReadEventLogW
RegFlushKey
DecryptFileW
ReportEventW
OpenThreadToken

wininet

FreeUrlCacheSpaceA
GopherFindFirstFileA
GopherOpenFileW
FtpGetFileW
HttpQueryInfoA

Sections

.text
Size: 48KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 24KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE