1868c5675ebf74e1ef2e4bc18ae33a13 | Triage

Sharing

General

Target

1868c5675ebf74e1ef2e4bc18ae33a13
Size

51KB
MD5

1868c5675ebf74e1ef2e4bc18ae33a13
SHA1

ee317e72e1489e3a9c2a0d58893d9287d56b1340
SHA256

e6d2b0128f06192646cbf1c17d6e80811cf315d174f6326b64464b5225e14d40
SHA512

9db04912072aa9f098beefaea76d4231b5c234224c45a38e878541e18c78f4e4ce20702645ba0771cd9cbe247954b6b9de775ed51a72e3c9767d2253cfdd02b9
SSDEEP

1536:exzvchUA/yLZBAnyn7guwK+H+p1jITXdD0:e1cB/yMnynV+H+p1UjdD0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1868c5675ebf74e1ef2e4bc18ae33a13

Files

1868c5675ebf74e1ef2e4bc18ae33a13
.exe windows:5 windows x86 arch:x86

3d405baed2852cceef36feee35e5bb88

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathCombineW
wnsprintfW
StrStrW
wnsprintfA
PathFileExistsW
wvnsprintfA
PathRemoveFileSpecW
SHDeleteKeyA

advapi32

RegQueryValueExA
CryptCreateHash
CryptGetHashParam
RegCloseKey
RegDeleteValueA
GetUserNameW
CryptDestroyHash
CryptHashData
CryptReleaseContext
DuplicateTokenEx
RegCreateKeyExA

kernel32

GetUserDefaultUILanguage

Sections

.uhgh
Size: 41KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vwr
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tgtgl
Size: 5KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ