2121828f98cd1c4acdb6d399c59153f2 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2121828f98cd1c4acdb6d399c59153f2
Size

66KB
MD5

2121828f98cd1c4acdb6d399c59153f2
SHA1

aa1efc8e03568d7a38af837302608a5b1816ae7a
SHA256

7bc0a438d34e7f2223f70f53bc2e83df00c74717c6f889160ddd28b9eedef7bc
SHA512

2f29d94216d6009037e78989aa989f3206fd83b67bf2f1cec129b5d5bee4b6eee04a030f977decb4d3c97f2b6e4b568bcf5c3694956d23ae90bdf62589572278
SSDEEP

1536:d0OTyF4Yx8SsNWT0KXrQgNKtgJvNBwuASwwUAOFSW8jkfMcIRK:d06a4YtsNWT0mcgNkgJlBwHPSX4e

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2121828f98cd1c4acdb6d399c59153f2

Files

2121828f98cd1c4acdb6d399c59153f2
.exe windows:4 windows x86 arch:x86

747792398f1697a6fe2a16c0fd3af299

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
InterlockedIncrement
GetEnvironmentStringsW
LCMapStringW
DeviceIoControl
GetTickCount
Sleep
DuplicateHandle
SleepEx
GetCommandLineA
ExitProcess
VirtualProtect
GetCurrentThreadId
HeapCreate
GetCPInfo
GetPrivateProfileStringA
GetCurrentProcessId
GlobalUnlock
RtlUnwind

advapi32

RegOpenKeyA
RegOpenKeyExA

msvcrt

__dllonexit
_wtoi
_amsg_exit

user32

SetWindowRgn
GetScrollInfo
CharNextW
DestroyMenu
IsWindowVisible
CreateWindowExW
GetClassNameW
KillTimer
DrawEdge

ole32

CoTaskMemFree
CoTaskMemAlloc

gdi32

CreateFontIndirectW
CreatePen

Sections

.text
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 86B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ