397fe5845cf552eee392eabcc8bfba84 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

397fe5845cf552eee392eabcc8bfba84
Size

45KB
MD5

397fe5845cf552eee392eabcc8bfba84
SHA1

4cf68d548871a3f44c25c45d250621c62e8d38d6
SHA256

13cb238b01e0f5c195d3ffdb67d4960b1be4817545c27e9c1ea5cef11b2103e1
SHA512

adf01db49a7f196de59b60025a3f1b777762aa3886db54102ee0bf78563801ed94741ff81b9359849593a2b063d86154d82f0506cfbd012599498473d0875731
SSDEEP

384:zMRa/Tgjlrx4adAiCRQDrqNsuCKXzPKvwEq5emif7aOs3MQ5rPfr1ncS9f:BKx4aCiCQRCXMbq5en45ry4f

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
397fe5845cf552eee392eabcc8bfba84

Files

397fe5845cf552eee392eabcc8bfba84
.exe windows:4 windows x86 arch:x86

e54e99b02c38bff0879cfd75a5276944

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
ExitProcess
Sleep
GetCommandLineA
ResumeThread
VirtualLock
CloseHandle
UnmapViewOfFile
GetProcAddress
GetModuleHandleA
GetTempPathA
VirtualAlloc

user32

wsprintfA

advapi32

CryptAcquireContextA

ole32

CoUninitialize

msvfw32

DrawDibTime

crypt32

CertCloseStore

winmm

midiInClose

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 732B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: 188KB - Virtual size: 555KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ