636b5095c49b8f1bfcdd97b27dab96c9 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

636b5095c49b8f1bfcdd97b27dab96c9
Size

132KB
MD5

636b5095c49b8f1bfcdd97b27dab96c9
SHA1

2e1732bb9d955578bb601c527af08b1c9dfdfaad
SHA256

08e19ff23b9770b1b45913c9d45cfc7f518ac827f015cbe5539cc2730af1f1fb
SHA512

c3bb1deb0f994db3df1e5517a1031c7b9e00a9fa9cdde85319aeb434ac7adb6f297b20937fb2258f2d250f0452edc8eccccb2b21f72547dd8defc74cf3ee1731
SSDEEP

3072:Jxlr5dpho1Nlnzc3gEaNwAXwxxMRkPh/W66ys3kCS6KX73dBXviox62:JxlNIxygEaN1wxxMy4BLc5f7x

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
636b5095c49b8f1bfcdd97b27dab96c9

Files

636b5095c49b8f1bfcdd97b27dab96c9
.exe windows:4 windows x86 arch:x86

5549d8829f3cbfabc7c2f004e53289f8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

DoEnvironmentSubstW
DuplicateIcon
RealShellExecuteW
Options_RunDLLW
Control_RunDLLA
SHFileOperationA

comdlg32

ChooseColorA
dwLBSubclass
PrintDlgExA
FindTextW
ReplaceTextW

Sections

.text
Size: 89KB - Virtual size: 90KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE