74fe9a9a475052a75721c1952387dbd1 | Triage

Sharing

General

Target

74fe9a9a475052a75721c1952387dbd1
Size

324KB
MD5

74fe9a9a475052a75721c1952387dbd1
SHA1

8f14acf0bf815034b0d5e70fa1e5158e0862806d
SHA256

c1b387b83c127dc721ff109d411038d1d6d81085affdbca6b97c294507541832
SHA512

cf8ddfd904ff9d5673d806627c200379320f9187a703d64f5a1b436d17285f5437c7e5828c9fab26a3fe651f29dd2b94125505a5c95dc6d24bb2f0a4294c9ee9
SSDEEP

3072:S6q89fak452bDxlPrfAoab1Gw2pp5ENZD19c5:S789fak45CCz2ppGM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

74fe9a9a475052a75721c1952387dbd1

Files

74fe9a9a475052a75721c1952387dbd1
.exe windows:4 windows x86 arch:x86

27017f173055a24fd9cc53254ecb4c0b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTempPathA
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapFree
IsBadReadPtr
DeleteFileA
CloseHandle
WaitForSingleObject
CreateProcessA
GetStartupInfoA

shell32

SHGetPathFromIDListA
SHGetSpecialFolderLocation

urlmon

URLDownloadToFileA

user32

wsprintfA
MessageBoxA

Sections

.text
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 614B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE