470b1d8bd341267b5ff59e02338e9aed | Triage

Sharing

Copy URL Twitter E-mail

General

Target

470b1d8bd341267b5ff59e02338e9aed
Size

71KB
MD5

470b1d8bd341267b5ff59e02338e9aed
SHA1

2e2848b67b8f34036dc187a967eb6fae221d3f6d
SHA256

f71cc067ac841d41e2decccd3b0c12745f172eab618a16c2aa90c671344a2de8
SHA512

767a25e500c7f4f85b26d9c7996dbed64fbe42892c92ff903bb282f0e63a06c6cdfda94471f9957d84cee7622ecf4b4e497bc2ee64631c5f99419b363f0b5f65
SSDEEP

1536:jZuyuG/Q6RHKi9naChi3tYmLKjwfjvGmKAhY52FwMkJlZXBF7eq8IH:VutG/Q6plhidtujwfjvGmKyYIcUq8U

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
470b1d8bd341267b5ff59e02338e9aed

Files

470b1d8bd341267b5ff59e02338e9aed
.exe windows:4 windows x86 arch:x86

812648e0cb448422147c5ddb2b4b19aa

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
ExitProcess
GetModuleHandleA

msvcrt

_controlfp

advapi32

RegCloseKey

shell32

ShellExecuteA

Sections

pec1
Size: 2KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 67KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE