SecuriteInfo[.]com[.]FileRepMalware[.]15877[.]22966 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

SecuriteInfo.com.FileRepMalware.15877.22966
Size

458KB
MD5

f7ff443dd0b5419c582956c7723b1783
SHA1

cad92096ca7dc9123aa2262ec65bfa16e5741add
SHA256

03d89b38a4198f5974981a2582e46a13047f5f275489b70ba863449dfd68ceac
SHA512

836b77869868c5c68ff962334e5d56c515c1260785f57bd6c1130c95beded0507f77ac0d56c6ce0752f74bbea58f972f1ad45abb0ac2fc7f83445c6bbccfe758
SSDEEP

12288:MacKESrjkbLb6NreyPKjkUI42ACqRXNdtX1:MacKqRjkUh2s93l

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SecuriteInfo.com.FileRepMalware.15877.22966

Files

SecuriteInfo.com.FileRepMalware.15877.22966
.exe windows:5 windows x64 arch:x64

48e414e431433a62713440d22abb8343

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

wsock32

gethostbyname

winmm

mixerOpen

version

VerQueryValueW

comctl32

ImageList_Create

psapi

GetModuleBaseNameW

wininet

InternetOpenW

user32

GetDC

gdi32

BitBlt

comdlg32

GetSaveFileNameW

advapi32

RegCloseKey

shell32

DragFinish

ole32

CoGetObject

oleaut32

SafeArrayGetLBound

Sections

.MPRESS1
Size: 429KB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE