36c0fa1db0f0cebb44985355be20b8a6 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

36c0fa1db0f0cebb44985355be20b8a6
Size

216KB
MD5

36c0fa1db0f0cebb44985355be20b8a6
SHA1

91c03a0bb7c6ac7838c9afb982ad6e7171e94833
SHA256

0e06d56ffcb4855391f7e115ccf353b9e60508e589b348fe797590d6258c7821
SHA512

6b676cd84862b3febc8d266444a05c5004302d797599a1e2ff9092ac28a84009b92d6e1f3eb397e38fa3033f0f2166eb6e7e44c41a6d306c764e37ae9e6c72dd
SSDEEP

6144:0UPzYwhJfLfsh8CYvCmCsMIEuusQC+JUBXzCmm86t:dMwnfLfsh8ChmLMft206mft

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/aim_css/aim_css/aim_css/ЧИТ ДЛЯ КОНТРЫ/holzed.exe

Files

36c0fa1db0f0cebb44985355be20b8a6
.rar
aim_css/aim_css/aim_css/ЧИТ ДЛЯ КОНТРЫ/changelog.txt
aim_css/aim_css/aim_css/ЧИТ ДЛЯ КОНТРЫ/friends.ini
aim_css/aim_css/aim_css/ЧИТ ДЛЯ КОНТРЫ/holzed.exe
.exe windows:4 windows x86 arch:x86

beece77ce1457eeaeda3a4c8fd98bd8f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

IsDialogMessageA

gdi32

SetMapMode

shell32

ShellExecuteA

comctl32

ord17

shlwapi

PathFindExtensionA

oleacc

CreateStdAccessibleObject

winspool.drv

DocumentPropertiesA

advapi32

RegDeleteKeyA

oleaut32

VariantChangeType

Sections

.text
Size: 197KB - Virtual size: 372KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
aim_css/aim_css/aim_css/ЧИТ ДЛЯ КОНТРЫ/keys.txt
aim_css/aim_css/aim_css/ЧИТ ДЛЯ КОНТРЫ/readme.txt
aim_css/aim_css/aim_css/ЧИТ ДЛЯ КОНТРЫ/settings.ini