ec4e416dad22b4e7365d8256f2066c67[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ec4e416dad22b4e7365d8256f2066c67.exe
Size

52KB
MD5

ec4e416dad22b4e7365d8256f2066c67
SHA1

d2aad52d754d753bee73b8c5d6710cbf8b6eaff2
SHA256

53e7060a479c5698b3f524719ea8646355f4b356a1ae28be82c7ad0221fe37df
SHA512

fa660e948744995e4820f794825e3b3e22b38dd72ec7500dbf5541cf97183a6df490a35f3afc34b71f7e6288fa95f899c52c1db921d1ab070bb8ab33c5573789
SSDEEP

1536:a3idBevKuP4LCb/YiLZY9My7ye6Us9F9Ev:aydBeCubb/YiWZ7yeTs7+v

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ec4e416dad22b4e7365d8256f2066c67.exe

Files

ec4e416dad22b4e7365d8256f2066c67.exe
.dll windows:4 windows x86 arch:x86

471c72f112e180f798a6fe17ec9ef21f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

BlockInput

gdi32

GetDIBits

advapi32

LsaFreeMemory

shell32

SHGetSpecialFolderPathA

msvcrt

_strnicmp

winmm

waveOutUnprepareHeader

ws2_32

WSAStartup

msvcp60

?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ

imm32

ImmReleaseContext

wininet

InternetReadFile

msvfw32

ICSeqCompressFrame

wtsapi32

WTSFreeMemory

userenv

CreateEnvironmentBlock

psapi

EnumProcessModules

Exports

Exports

Install
MyNewFun
wintest

Sections

.text
Size: 45KB - Virtual size: 136KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE