401bfac20608a50b58b488c462a23217 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

401bfac20608a50b58b488c462a23217
Size

45KB
MD5

401bfac20608a50b58b488c462a23217
SHA1

8bb6f320c5975f7f9cbc8f8ee981ff00bde8c9a7
SHA256

aa8869da49fe4a9362622e4e1f0436df630fafa3d3e0f710854bec6b7cb55fb6
SHA512

22bd39a2d07ed5cd420d9741ebc025f2f729347276ea40d779e6c8fe5e12ec1ab3987ae48ae71a618f3a9848671ef9061343d6465995eacb7e0dac1a04c84d6d
SSDEEP

768:53ZI0S8ORHAm7ttLTv1a3UEdQj5rS8F9vxDbhP/IVQpRgENbBgEIO/Jd1B3E:5pI0S8ONDI3zQ1rSwJNhTmENOq/VB0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
401bfac20608a50b58b488c462a23217

Files

401bfac20608a50b58b488c462a23217
.exe windows:5 windows x86 arch:x86

b1c42218b9b7780338ba82e3baea0e6d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

CryptReleaseContext
RegCloseKey
CryptGetHashParam
RegQueryValueExA
RegDeleteValueA
DuplicateTokenEx
CryptCreateHash

shlwapi

PathFindFileNameW
PathFileExistsW
PathMatchSpecW
PathCombineW
StrStrW
wvnsprintfW
wnsprintfA
StrCmpNIW
wvnsprintfA
PathRemoveFileSpecW
SHDeleteKeyA
wnsprintfW
StrCmpNIA

Sections

.oxovmr
Size: 36KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ypotwf
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tyhgb
Size: 5KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ