4d20881e559cfc0eb0eb8f9673a36500 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4d20881e559cfc0eb0eb8f9673a36500
Size

2.8MB
MD5

4d20881e559cfc0eb0eb8f9673a36500
SHA1

ddd54a45f260730cafe72fe5c8ce969ff67d1ed6
SHA256

a0220ee7bd7d13b70f84f7746d6622ce87a249c470e2cac7c49263a1b073101b
SHA512

9798671243a9fbe60f53b304351d84a12adb378c39dabaaa002545502cf8d3cd515085f4660624d1979986ac5195719215c2f1a30058968594a601d134e29bd3
SSDEEP

49152:406XzLOAaUW4Dbavd6ayVsUZR62mVJlkUG6nHmZHqiiu67jbd:nc+EVfZA2e

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4d20881e559cfc0eb0eb8f9673a36500

Files

4d20881e559cfc0eb0eb8f9673a36500
.exe windows:4 windows x86 arch:x86

ab80848b63858b095609636c67f4a87f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathFindFileNameW

kernel32

GetProcAddress
FindResourceW
CloseHandle
WriteFile
CreateFileW
SizeofResource
LockResource
LoadResource
FindResourceExW
FreeLibrary
GetTempPathW
LoadLibraryW
CreateProcessW
lstrcatW
GetModuleFileNameW

user32

LoadStringW

Sections

.text
Size: 1024B - Virtual size: 815B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 711B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ