645ff663468e1db930ad192fb948aca5 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

645ff663468e1db930ad192fb948aca5
Size

45KB
MD5

645ff663468e1db930ad192fb948aca5
SHA1

5dddf90277823b64de91538e55ef34edd3c2549f
SHA256

ed6ecfce3622e1c3f56cbe1a4150ca348e607047ddffc8fd05b0c5a4ee9fbf73
SHA512

1f2dec9902620d8e96fce18e9ac42b138c7492b5bbfbb85423a31a0d1ea418a697dd5224f732e30c2964bb97815b01f823b472d13135ba58827c156001f3450d
SSDEEP

768:zWI1mu3fexJJd/qHzx5isGNFFrE0ynLv/vuXOF:zWDI+TBqTHClynLXvueF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
645ff663468e1db930ad192fb948aca5

Files

645ff663468e1db930ad192fb948aca5
.exe windows:4 windows x86 arch:x86

c9b3349dfe1d34e88e31b663cecebb0a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
GetKeyboardType

kernel32

GetModuleFileNameA
GetEnvironmentVariableA
ExitProcess
FormatMessageA
GetLastError
SetLastError
GetProcAddress
VirtualProtect
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
GetModuleFileNameW
GetVersionExA
VirtualFree
VirtualAlloc
GlobalAlloc
SetFilePointer
ReadFile
CreateFileA
LoadLibraryA

advapi32

RegQueryValueExA

oleaut32

SysFreeString

version

VerQueryValueA

gdi32

UnrealizeObject

ole32

CreateStreamOnHGlobal

comctl32

ImageList_SetIconSize

wsock32

WSACleanup

Sections

.text
Size: 45KB - Virtual size: 15.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE