456bee9ee3747079b233ae3f2bd8db71 | Triage

Sharing

General

Target

456bee9ee3747079b233ae3f2bd8db71
Size

61KB
MD5

456bee9ee3747079b233ae3f2bd8db71
SHA1

417b3d597b5b46f9eeb02299ef0aa3a683ed37a0
SHA256

49884a80962abbb68a0e2a45a8f06a14e9d349b0d67a0fae9a2577d4ff904ca4
SHA512

ddceb33d8eb971bc5199509b6b285634658be4b73dd714bfc309a1c51d6d793937de6f7df0e1886415dd8417e740b48be7bf21e0f6b4d543fdae427bf7719d49
SSDEEP

1536:D5NelqRZPPy83Tegj4/Bms2aFB0up4JI4OEQ5mVQ3agYd:D5NIKrimWFZpVA6mGagY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
456bee9ee3747079b233ae3f2bd8db71

Files

456bee9ee3747079b233ae3f2bd8db71
.exe windows:4 windows x86 arch:x86

920f23173a0a9b999b453e1c9e88a955

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

version

GetFileVersionInfoA

user32

CreateWindowExA

gdi32

Rectangle

advapi32

RegCloseKey

shell32

ShellExecuteA

wininet

InternetCrackUrlA

shlwapi

SHDeleteValueA

lz32

LZClose

msvcrt

abs

ws2_32

gethostname

ole32

CoUninitialize

oleaut32

SysFreeString

urlmon

URLDownloadToFileA

Sections

.text
Size: 54KB - Virtual size: 140KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE