212ed115e3880dd24329894e9829547b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

212ed115e3880dd24329894e9829547b
Size

66KB
MD5

212ed115e3880dd24329894e9829547b
SHA1

4292ff2b2ca05e4ede32d7bf0c8e2497767a75f1
SHA256

46a851ae68e39c0418126f16e30ff40e5a39375ef0acec8c9730287dfed440cf
SHA512

9eb27989a2ff53a756cfde2b39e18c14a49837867e6a5bf89bb0ac8822908c9501de49b8a04a334c4a9e35f9a5bba9567d316821782d37edae9f9a54bcf61104
SSDEEP

1536:HsrTImGCxTil5vaKtfUHl1jeeeeeeMeeeeeeWLU:HsnT9R

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
212ed115e3880dd24329894e9829547b

Files

212ed115e3880dd24329894e9829547b
.exe windows:5 windows x86 arch:x86

a966e463b1d97c424875cf2b38e08e04

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

CheckDlgButton
GetParent
GetProcessDefaultLayout
GetMenu

kernel32

lstrcpyW

shlwapi

UrlCanonicalizeW
PathMatchSpecA

Exports

Exports

ExoPortalIE
?SelectionUpgrade1@@YG_JEPAXUfurrone2897320391401938091831@@WE
?SelectionUpgrade2@@YG_JEPAXUfurrone2897320391401938091831@@WE
?SelectionUpgrade3@@YG_JEPAXUfurrone2897320391401938091831@@WE
?SelectionUpgrade@@YG_JEPAXUfurrone2897320391401938091831@@WE

Sections

.text
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.zero
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 10KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ