387e0553525dda60ea9eef9ba67b89d1 | Triage

Sharing

General

Target

387e0553525dda60ea9eef9ba67b89d1
Size

17KB
MD5

387e0553525dda60ea9eef9ba67b89d1
SHA1

a6e8c08cf8528814200685859095de1ecfabd962
SHA256

e2582d40ae87f69668858059c34f14c2fd127d16e6dad39cd005823f3d5c77e5
SHA512

eb3464f92281cfc2aa931a369d309024e54056fcbcc7c861fb286a6f4c4ca0ff143279f4ac9c228d9422c7c71258ef90115e771b8768038df57b8179033f8744
SSDEEP

384:1YM9pssSE2MNJgR6bu4ElcMvPNevFYvd:1YM9VsMNJhIjevmV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
387e0553525dda60ea9eef9ba67b89d1

Files

387e0553525dda60ea9eef9ba67b89d1
.exe windows:4 windows x86 arch:x86

794754a6b40ba3e9d2a96a3b03b25cab

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

urlmon

URLDownloadToFileW

kernel32

GetModuleFileNameW
GetLastError
CreateFileW
HeapReAlloc
VirtualAlloc
ExitProcess
GetModuleHandleA
GetStartupInfoW
GetVersionExA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
GetProcAddress
TerminateProcess
GetCurrentProcess
WriteFile
GetStdHandle
UnhandledExceptionFilter
HeapSize
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
LoadLibraryA
RtlUnwind
InterlockedExchange
VirtualQuery
HeapAlloc

shell32

ShellExecuteW

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE