18d49de1e3003d93d96b727afc369be5 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

18d49de1e3003d93d96b727afc369be5
Size

803KB
MD5

18d49de1e3003d93d96b727afc369be5
SHA1

39ec87ccc96d68d969bbc3619429ef8ff0449787
SHA256

08c563f88894611409e6e123969456d66620c1a604bad215227dad7895b26e8f
SHA512

b627df226268bf7c103338b63f2cdd50c2fc6ed351548c4f8fc7e76307bba727391514581bc8b118250d7c7f1ecf259e7bcbe04d850d6341387d6e07fa723750
SSDEEP

24576:K1mxKnTIae1ed34ba1UGIXnnRBWYJP/Q+:1Dbda1U33RXX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
18d49de1e3003d93d96b727afc369be5

Files

18d49de1e3003d93d96b727afc369be5
.exe windows:4 windows x86 arch:x86

c4523d34e9ff36399b4784d169d442fb

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetTickCount
HeapDestroy
FindAtomW
DeleteFileW
CreateFileW
PulseEvent
GlobalFlags
VirtualProtectEx
GetDriveTypeW
CreateDirectoryA
GetFileAttributesA
GetModuleHandleA
GetProcessVersion
GetVolumePathNameA
IsValidLocale
InterlockedExchange
SetFilePointer
OpenEventW
GetModuleFileNameA
OpenMutexW
DeleteFileW
CreateFileW
SetFileTime
LeaveCriticalSection
GetCurrentThreadId

user32

DestroyMenu
GetWindowLongA
LoadCursorA
SetRect
wsprintfA
SetFocus
GetWindowLongA
MessageBoxA
IsMenu
GetWindowTextA
DestroyIcon
DispatchMessageA
PeekMessageA

dpnhpast

DllCanUnloadNow
DllUnregisterServer
DllGetClassObject
DllRegisterServer

advapi32

IsValidAcl

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 793KB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE