536843745866ba07618740e25035d99c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

536843745866ba07618740e25035d99c
Size

352KB
MD5

536843745866ba07618740e25035d99c
SHA1

efe50a002447157ccab0054d3c5a8e4bfae2b9d6
SHA256

cc4c7091bafe1032136827112dcad28cfa2ba72351731e0d8f81f5c3be90cf39
SHA512

d831a1df8b777ad186ea614dd963e0a92fdfe84c872fb6c43b12745a4b4b3e604067530cd2055737c4755ffc6eaf978f3701f9ca3dcfff053062cc4a16be952c
SSDEEP

6144:1qB3R5HdilW2566m4KfoT2rRWZEiATtYv1hVGichjS15I8dWPm6n7k9nww:1yTHEl3lm4KfbrRZWdCich0muQ7kZw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
536843745866ba07618740e25035d99c

Files

536843745866ba07618740e25035d99c
.exe windows:4 windows x86 arch:x86

45824fb6cb0357bc8f7b842963574ebe

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualFreeEx
ExitProcess
Sleep
GetLastError
ResumeThread
GetModuleHandleA
HeapFree
GetProcAddress
VirtualAlloc
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
TerminateProcess
GetCurrentProcess
LoadLibraryA
RtlUnwind
HeapReAlloc
HeapAlloc

advapi32

CryptAcquireContextA
CryptGenKey

ole32

CoUninitialize

avifil32

AVIBuildFilterA
AVIStreamBeginStreaming

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 236KB - Virtual size: 234KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 530KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 92KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.svga
Size: 4KB - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ