176f4e0237d64f70b37db965fe025e1a | Triage

Sharing

General

Target

176f4e0237d64f70b37db965fe025e1a
Size

12KB
MD5

176f4e0237d64f70b37db965fe025e1a
SHA1

97617db626c94f0a55468da52f9a07f72b948098
SHA256

e2ebe597a21b3d7e7c891c191f8d01cd16e75b21cb7170237e2e0fbae5a8a7d9
SHA512

ecae39829d44587c4cc5a8822b05d34b88251bd77c49135da2bb6494c18a831284e7d1adca644b682af3cfb4d9d0bfd55a630a0696e955a2eb240ee1b018fbfe
SSDEEP

192:av5hqQpbGR2BF+zpF3vawUvxFey3kieaf+S/Tsbitn75h/T0wfs0rcgmRsa:Q9ViVF3vaJJ8y5eW5wAnDQwf7QgmRs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
176f4e0237d64f70b37db965fe025e1a

Files

176f4e0237d64f70b37db965fe025e1a
.exe windows:4 windows x86 arch:x86

976d556cb259df2a5c0c3be0a88bb033

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SleepEx
FindClose
VirtualProtect
GetCommandLineW
GetCurrentProcessId
DeleteFileW
IsDBCSLeadByte
GlobalUnlock
LeaveCriticalSection
MultiByteToWideChar
ReadFile
LoadLibraryA
DeleteCriticalSection
GetEnvironmentStrings
InterlockedDecrement
InterlockedExchange
OutputDebugStringA
ExitProcess
GetLastError
GetCommandLineA
WriteConsoleW
Sleep
GetCurrentProcess

msvcrt

memmove
wcsncmp
_adjust_fdiv
memset
calloc

advapi32

RegQueryValueExA
RegOpenKeyExA
RegDeleteKeyW

user32

LoadCursorW
KillTimer
ClientToScreen
GetMenuItemID
DispatchMessageW
DispatchMessageA
CharNextA

gdi32

Rectangle
CreateFontIndirectA

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 178KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ