19ffdaefda06f0c259bff00e35ca138e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

19ffdaefda06f0c259bff00e35ca138e
Size

9KB
MD5

19ffdaefda06f0c259bff00e35ca138e
SHA1

93562e35e6bbc245d16390fe182a428c4c629838
SHA256

fc79cf283e23f49a6805947b80666d09adf50f7fcea91d9cc6aeaa9d5520ca1e
SHA512

75f0c115e127c7053fb8250fe072162aedf9ed343318b81cd86ebbda9d6724301ed0098e61d8e8da19e5e799570fae1797b2bf0801d6e0919a7d773aa0214d5a
SSDEEP

192:ryjnWSPvKrKAb7ZJLYE8tZUXq6CIXaamW:ryjWSPiWADmtZU/OPW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
19ffdaefda06f0c259bff00e35ca138e

Files

19ffdaefda06f0c259bff00e35ca138e
.exe windows:5 windows x86 arch:x86

767f20450f467c2a044020006c678251

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

urlmon

URLDownloadToFileA

kernel32

lstrcpyA
IsDebuggerPresent
ExitProcess
lstrlenA
CreateProcessA
lstrcatA
GetTempFileNameA
ContinueDebugEvent
WaitForDebugEvent
CloseHandle
GetTempPathA
DeleteFileA
RtlUnwind
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess

user32

wsprintfA

shell32

SHGetSpecialFolderPathA

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 848B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 424B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ