40c375a3d027e7ce7106857bcea037cb | Triage

Sharing

Copy URL Twitter E-mail

General

Target

40c375a3d027e7ce7106857bcea037cb
Size

64KB
MD5

40c375a3d027e7ce7106857bcea037cb
SHA1

f2cfaef2bf02d3ca213af6c3bbf21a9ca192e78a
SHA256

5cf21cb424807a58b4deee4db4a855535a58b46023e9a7d21c6e45d5317ba3bb
SHA512

6e522e60c91b52148853a35b8007a7a82083ba4996c99116b2fdeafa54bf1939b1093678f43fabf1152e3a97548bab099d20a210f906bb4b7d27b61a8f9f5d05
SSDEEP

1536:b9CdTWiqCTkhT7oJ7jdzDe+57j4GN8oDYuc:6MCTOPydzUikr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
40c375a3d027e7ce7106857bcea037cb

Files

40c375a3d027e7ce7106857bcea037cb
.exe windows:4 windows x86 arch:x86

775efa6183580b7e49e39e8cc4a9b08f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualProtect
VirtualAlloc
lstrcpyA
LoadLibraryA
ResetEvent
CreateFileA
HeapFree
EnterCriticalSection
ExpandEnvironmentStringsW
GetVersionExW
GetFileAttributesA
GlobalLock
CloseHandle
lstrcmpiA
HeapReAlloc
OpenMutexW
lstrcpynW
lstrcatW
SetFilePointer

advapi32

GetUserNameW
CryptAcquireContextW
CryptReleaseContext
RegQueryValueExA
CryptDestroyHash
CryptGetHashParam
RegDeleteValueA
CryptCreateHash
CryptHashData
RegCreateKeyExA
DuplicateTokenEx
RegSetValueExA

user32

OpenDesktopA
DispatchMessageA
GetDlgItem
GetIconInfo
EndDialog
GetWindowLongA
LoadCursorA
SendMessageA
GetClipboardData
FindWindowExA
GetWindowThreadProcessId
OpenWindowStationA
SetThreadDesktop
GetForegroundWindow
CloseDesktop

shlwapi

PathMatchSpecW
PathFindFileNameW
PathFileExistsW
StrCmpNIA
wvnsprintfA
PathCombineW
wnsprintfA
StrCmpNIW
StrStrW
wnsprintfW

Sections

.text
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE