4dd3d0713eaa63a1f4056eb98f29fe22 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4dd3d0713eaa63a1f4056eb98f29fe22
Size

352KB
MD5

4dd3d0713eaa63a1f4056eb98f29fe22
SHA1

caec370527b736259e4aea2999e3a1088f9870eb
SHA256

237976f1aafa538c8999870961e333f0827929a03f8d3e7081850a465534558b
SHA512

65c63e88234ea09dba9485f1427ef9bc5d9a08e37d9bfe9cd5c0d9f4ac73dc50aed8741ab7dcb1323e27188a859c0fbebaf31ff965030beecf4f6441540ddf02
SSDEEP

6144:gqB3R5HdilW2566m4KfoT2rRWZEiATtYv1hVGichjS15I8dWwm6n7k9nww:gyTHEl3lm4KfbrRZWdCich0muv7kZw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4dd3d0713eaa63a1f4056eb98f29fe22

Files

4dd3d0713eaa63a1f4056eb98f29fe22
.exe windows:4 windows x86 arch:x86

45824fb6cb0357bc8f7b842963574ebe

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualFreeEx
ExitProcess
Sleep
GetLastError
ResumeThread
GetModuleHandleA
HeapFree
GetProcAddress
VirtualAlloc
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
TerminateProcess
GetCurrentProcess
LoadLibraryA
RtlUnwind
HeapReAlloc
HeapAlloc

advapi32

CryptAcquireContextA
CryptGenKey

ole32

CoUninitialize

avifil32

AVIBuildFilterA
AVIStreamBeginStreaming

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 236KB - Virtual size: 234KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 530KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 92KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.svga
Size: 4KB - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ