469a0a2491d89265abf457e15e0fb1fa | Triage

Sharing

Copy URL Twitter E-mail

General

Target

469a0a2491d89265abf457e15e0fb1fa
Size

5KB
MD5

469a0a2491d89265abf457e15e0fb1fa
SHA1

dd216d85a22fe7338283daa4a73793990827381a
SHA256

5df56cf2956d2b8e39bec4c5f3b881cffd958f5d306fadd74bd5bc3cfee2dd6b
SHA512

2ed3bd58b586de754def1174ffca19ccabf06df75778f32b6a20f993e6457e52f2842d63684b3b50acf47be68806cb668597f02cd8580d0b858cfc26424ee3f0
SSDEEP

96:3rjvW2u33exhyx3mQVlM3BnE3I49rxmi:3PvWD3NlGBnKI49Nmi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
469a0a2491d89265abf457e15e0fb1fa

Files

469a0a2491d89265abf457e15e0fb1fa
.exe windows:4 windows x86 arch:x86

c3d738a71b6635c6a5e1fc8b3f3ff2ab

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WideCharToMultiByte
GetModuleFileNameW
lstrcatA
CreateToolhelp32Snapshot
Process32First
CompareStringA
WaitForSingleObject
lstrcpyA
CreateEventA
CloseHandle
GetModuleHandleA
GetProcessHeap
HeapAlloc
HeapFree
ExitProcess
SetEvent
CreateThread
GetProcAddress
ExitThread

user32

GetDesktopWindow
GetParent
DestroyWindow
MsgWaitForMultipleObjects
DispatchMessageA
TranslateMessage
PeekMessageA
CreateWindowExA

gdi32

SelectObject

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyA

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE