2d5bb0d48738b796d5239dee696a8899 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2d5bb0d48738b796d5239dee696a8899
Size

430KB
MD5

2d5bb0d48738b796d5239dee696a8899
SHA1

99a7fc39ce5e9d9d5fad2c6a1599dfad8b02821e
SHA256

fd8115498099ea956e843482e041a765f77acbf2571c52dd139903d4234b1cf6
SHA512

cc6716227dec8f050a238fecb0ae167623739cff9f70a2a2c82b562f2832c2596f71061d7def06054c76a74bef3bb5d3238e26fe5b0008417cd0e6af1834ae6e
SSDEEP

6144:wt9pGBHBbtlfRq4qXK6b60p8XmgWafIlePqmKNvGzuM/6O4FQCdad8CL:wt9OhbH04GKW6i6rWafIUP2G+5HAmCL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/CharFind.exe

Files

2d5bb0d48738b796d5239dee696a8899
.rar
CharFind.exe
.exe windows:4 windows x86 arch:x86

1e258565f68079d771f42e55db1ec96a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

version

VerQueryValueA

gdi32

UnrealizeObject

ole32

CoTaskMemAlloc

comctl32

ImageList_SetIconSize

shell32

ShellExecuteA

Sections

CODE
Size: 396KB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 167KB - Virtual size: 168KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE