2d39ae67f38c319f8d758b7a786c4499 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2d39ae67f38c319f8d758b7a786c4499
Size

477KB
MD5

2d39ae67f38c319f8d758b7a786c4499
SHA1

a02e1be523a14ec4314f81e97a163a452a29360a
SHA256

ec0ab904cefc44258937d52806f8e0e1e757df2c8a5c115bbbe00482ed7c79d4
SHA512

3fd8a684ea2f4718e3ca7abb7f20e04c675e19c878fc50ceb222cebfc13ccbf8e0d68ad97e7ef8002ff10926c9c218b48f5231a4516273205bc72e917003d0eb
SSDEEP

12288:kQsatbc5NR/Ocw9jHhSCrEUFyE90Gb1dVNgNVcea:pfCbnMh3Ff7kNOf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2d39ae67f38c319f8d758b7a786c4499

Files

2d39ae67f38c319f8d758b7a786c4499
.exe windows:4 windows x86 arch:x86

f8819d48d7bcac70d30b3f28ab0486f9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
GetKeyboardType
CreateWindowExA

kernel32

GetModuleFileNameA
GetEnvironmentVariableA
ExitProcess
FormatMessageA
GetLastError
SetLastError
GetProcAddress
VirtualProtect
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
GetModuleFileNameW
GetVersionExA
VirtualFree
VirtualAlloc
GlobalAlloc
SetFilePointer
ReadFile
CreateFileA
GetACP
TlsSetValue
lstrcpyA
Sleep

oleaut32

SysFreeString
SafeArrayPtrOfIndex

advapi32

RegQueryValueExA
RegQueryValueExA

gdi32

UnrealizeObject

version

VerQueryValueA

comctl32

_TrackMouseEvent

urlmon

URLDownloadToFileA

wsock32

gethostname

Sections

.text
Size: 24KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE