20e24180b56d7e241c00441c6253e7e4 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

20e24180b56d7e241c00441c6253e7e4
Size

10.8MB
MD5

20e24180b56d7e241c00441c6253e7e4
SHA1

37bf1819bf5cce14e992b1d873fb719df8502366
SHA256

31a18fc981dd0b81bfa25ae4a7f84ecfc942e204889f9162d19e60467bd2746d
SHA512

cca566ff98ade5b0206e6b13271b2858bc7768a7edb335401034a0e760978249924d43b8c59af6580ddf688fe458759d6af82b42d483e18701690bcdc50562b5
SSDEEP

196608:br5s9vSlmNI8HFMZRiXBfLZxJe26xL5SaI/Io7yNzNHSRutS8lB80HnLRg:bIqDSMZRCBfc26xLNQ7kHS2B80HLRg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/5ifoto Desktop V3.0.0.0.EXE

Files

20e24180b56d7e241c00441c6253e7e4
.rar
5ifoto Desktop V3.0.0.0.EXE
.exe windows:4 windows x86 arch:x86

81638d02019c0bfcaaf23a9c69f2f12c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileMappingA
WaitForSingleObject
CreateProcessA
GetCommandLineA
CloseHandle
UnmapViewOfFile
WriteFile
MapViewOfFile
DeleteFileA
GetTempFileNameA
GetTempPathA
CreateFileA
GetShortPathNameA
GetModuleFileNameA

user32

wsprintfA

Sections

.text
Size: 512B - Virtual size: 510B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 533B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13.9MB - Virtual size: 13.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
新云软件.url
.url