442eeb5511301c239dbc0b16a090c808 | Triage

Sharing

General

Target

442eeb5511301c239dbc0b16a090c808
Size

236KB
MD5

442eeb5511301c239dbc0b16a090c808
SHA1

f9b3cac1ed7ea3c0a6b12e13c7d6b34718d1e393
SHA256

0d29f7cf843b1d9d5dbbe1cb40c47f2a2a45b561c457e7ed0fbff6e16fa9b481
SHA512

4f7aa204a0c42dd14351d90bf06c8151147dfec8469078aae46d9b4d6002331d2c128af504f9e56d485fc12332daa7e3069993e46fd23b27a0f7500eafe190b9
SSDEEP

6144:+sYcwn/GxQuVwmabT1DbK/2x47GXjKZpbT:fC/GxQuVw9bxD+3k0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
442eeb5511301c239dbc0b16a090c808

Files

442eeb5511301c239dbc0b16a090c808
.exe windows:5 windows x86 arch:x86

887216cd14dc07ac5c7539304e24449b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetMessageW

gdi32

DeleteObject

advapi32

AdjustTokenPrivileges

shell32

ShellExecuteW

ws2_32

WSAStartup

Sections

.text
Size: 208KB - Virtual size: 616KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 24B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE