5045dc8b2b5e62e3345ce584f834346b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5045dc8b2b5e62e3345ce584f834346b
Size

72KB
MD5

5045dc8b2b5e62e3345ce584f834346b
SHA1

c1205e782a15a8b5f6c122094e42bf010c4458d6
SHA256

0fe84dda7fd965f1c8ee513403a68af38666a3c8f656bc2ae30b56248775b950
SHA512

d520b2253faf02395c49e9c97f3c04aa909539b162f65ef5aef1aa7201630299ee17e102bf995b60e1aacfcab215c23744595d2173954676996c9b0516e6c807
SSDEEP

768:sz+yZcXE+dTOfTC2xLIrNYAmUU6bcmHI+t2JU6Ul:sRZN+JOfT5ErNDmUU0m+KU6Ul

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5045dc8b2b5e62e3345ce584f834346b

Files

5045dc8b2b5e62e3345ce584f834346b
.exe windows:4 windows x86 arch:x86

ab563389cf179dd54715b17d2a3b0cf2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

SetBkColor
SetTextColor
GetStockObject

user32

SendMessageA
RegisterClassExA
PostQuitMessage
MoveWindow
MessageBoxA
TranslateMessage
LoadCursorA
GetMessageA
GetCursorPos
DispatchMessageA
DefWindowProcA
CreateWindowExA
LoadIconA

kernel32

lstrcatA
WriteProcessMemory
VirtualAllocEx
Sleep
SizeofResource
SetThreadContext
RtlZeroMemory
ResumeThread
ReadFile
CloseHandle
CreateProcessA
ExitProcess
FindResourceA
GetModuleFileNameA
GetModuleHandleA
GetStartupInfoA
GetThreadContext
LoadResource
LockResource

ntdll

ZwUnmapViewOfSection

Sections

.text
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE