648d665935249f53a47f73b3004acec2 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

648d665935249f53a47f73b3004acec2
Size

179KB
MD5

648d665935249f53a47f73b3004acec2
SHA1

9a6f89a8c599190632509f2a1df34a0312575442
SHA256

59b1766b138683b059ee343b03f2de0f71c7714876094413032fc77065353748
SHA512

e30a4fbb14c8796aac76d3da0c4fa3b340c87a83206f0877a15516f38a5c3542f65e4f686f610d650e8221ffac10e8286e176e7985e7401aca1d3c3cfc8e0572
SSDEEP

3072:EsQIpx++b6zC8vVkLRmT1GfAm3bVKa4vKuyEWZnesHmD8xE0VP/kk9Qe+mqO469Z:1Zn++2zC8vKLeGfvj47rW1w8ZFkcQxOL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
648d665935249f53a47f73b3004acec2

Files

648d665935249f53a47f73b3004acec2
.exe windows:5 windows x86 arch:x86

213c10d8e4d057f363b1534b087ca3aa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ResumeThread
lstrcpyW
CloseHandle
lstrcpyA
SwitchToThread
WTSGetActiveConsoleSessionId
GetProcAddress
RtlMoveMemory
lstrcatA
Beep
GetProcessHeap
OutputDebugStringW
SetUnhandledExceptionFilter
HeapAlloc
SetErrorMode
lstrlenA
CreateThread
ExitProcess

ntdll

DbgPrint
wcsrchr
vsprintf
NtAllocateVirtualMemory

msvcrt

??3@YAXPAX@Z
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
??1type_info@@UAE@XZ
_CxxThrowException

opengl32

glVertex3d

user32

BeginPaint
KillTimer
GetMessageW
SetTimer
TranslateMessage
CreateWindowExW
ValidateRect
DefWindowProcW
DispatchMessageW
EndPaint
RegisterClassExW
MessageBoxA

gdi32

Ellipse
LineTo
Rectangle
SelectObject
SetTextColor
CreatePen
TextOutW
CreateFontIndirectA

advapi32

DuplicateTokenEx

comctl32

ord17

imagehlp

MapFileAndCheckSumW

wtsapi32

WTSQueryUserToken

Sections

.text
Size: 175KB - Virtual size: 174KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.qja
Size: 512B - Virtual size: 332B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE