4b3717119e8de325fbc25166112e490a | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4b3717119e8de325fbc25166112e490a
Size

443KB
MD5

4b3717119e8de325fbc25166112e490a
SHA1

c5f963bf026a5d910bfcbb44cbc0c7661357bac0
SHA256

a0be2d468e23a6c461376ce42251d9ea6577ca4671a0b58a9ca6e14f0200043c
SHA512

d34b6a38b66994843bc48cfaf5d6250ce4254f2ba02b2d2026124d346ff46529495abafefe6889b23bd6b6db8371f863fe1a1805905f94cce2daa7e78c212586
SSDEEP

12288:sBiB9g3iugrOff1ROwbw/BeL4GFmZ5RoD6Kgf:sosi1l/KgNw6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4b3717119e8de325fbc25166112e490a

Files

4b3717119e8de325fbc25166112e490a
.exe windows:4 windows x86 arch:x86

b9a2a15bdfb96a5d2d6270538071a78e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdiplus

GdipAlloc
GdipCreateBitmapFromFile

kernel32

FindResourceExW
FindResourceW
LCMapStringA
LoadResource
LocalFree
GetVersionExA
FindAtomA
lstrlenA
HeapAlloc
HeapFree
GetTickCount
GetProcessHeap
GetLastError
ExitProcess

gdi32

GetFontData
DeleteObject

user32

GetKeyState
KillTimer
SendMessageA
SetTimer
LoadIconA
LoadCursorA
RegisterClassA
CreateWindowExA
PostMessageA

Sections

.text
Size: 295KB - Virtual size: 294KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 804B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 139KB - Virtual size: 467KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ