2617bb6b4bd8d5ce66f191dc9d398b90 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2617bb6b4bd8d5ce66f191dc9d398b90
Size

355KB
MD5

2617bb6b4bd8d5ce66f191dc9d398b90
SHA1

7a8e2bbf97ea146309b7e36cfbc61448df72ddbe
SHA256

b3e27fad40845312fa201fa02af0a88b0e8ac4c4e7ae45f8984acfc33b2af23e
SHA512

f2b0b78dac7c065681af9554ab68e7edcbaa4dc3aa6166bd8d1fb44c336f583c64e293f7f707493e63f2506128eaff723f60fdbe95e292d33f1f46ba6f879e15
SSDEEP

3072:msHaRsJZZZHpeBCsvDrGPd3o+223sJn0xveYt4ry+:fMkZfwFvuFqws+e+4ry+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2617bb6b4bd8d5ce66f191dc9d398b90

Files

2617bb6b4bd8d5ce66f191dc9d398b90
.exe windows:4 windows x86 arch:x86

ee83c5c79d789b3f749f632cd0696a8b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

version

VerQueryValueA

urlmon

UrlMkGetSessionOption

shell32

SHGetSpecialFolderLocation

wsock32

WSACleanup

ntdll

RtlGetNtVersionNumbers

rpcrt4

UuidCreateSequential

Sections

CODE
Size: 118KB - Virtual size: 356KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE