21e17ed7be17f1c8c5c17f68c3d657de | Triage

Sharing

Copy URL Twitter E-mail

General

Target

21e17ed7be17f1c8c5c17f68c3d657de
Size

170KB
MD5

21e17ed7be17f1c8c5c17f68c3d657de
SHA1

31c5ea69e54be40639f67ba4f9666cb9bcc8d289
SHA256

00abaed92d14feac3436febfecf5e106f2b6a06bf97f29f05093932715298b9a
SHA512

9e7cf950f8c47324d0e91890be291f959280ce2af7d8636a1c65c9b3ecb45caef8534b97c428d4e76704ec801cd4dea9aafb27c39a88bdaf9fc32d96af8ca814
SSDEEP

3072:PqyBZ+rgfZQWWfrUJjIp/A1FRaacImfyRYd3AAAnEoUmsxMaYUJuajVp3GpUo4wK:yyT+razHOA13aac3OYinPk5Y4uapcUIT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
21e17ed7be17f1c8c5c17f68c3d657de

Files

21e17ed7be17f1c8c5c17f68c3d657de
.exe windows:4 windows x86 arch:x86

c5e112808441373aef701d800d73a1f4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ScrollConsoleScreenBufferA
SetConsoleMode
SetConsoleTitleA
SizeofResource
lstrcatA
ReleaseSemaphore
SetConsoleTitleW
CloseHandle

ntdll

RtlEqualComputerName

user32

ScrollWindow
CharToOemBuffW

ole32

CLIPFORMAT_UserFree
OleRun

gdi32

SetRectRgn
WidenPath
GdiGetBatchLimit
GetRandomRgn
ResetDCA
SetArcDirection
AddFontResourceA

shlwapi

SHRegWriteUSValueA

secur32

RevertSecurityContext

Exports

Exports

I1uSSX
J7q
K827
TUMOpSzlJhXlzJ
WqE
lsmkKT
vHPTA9pavXiqSptOe
yqzsYKaGBqHHZm

Sections

.text
Size: 139KB - Virtual size: 139KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 269KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ