78b9979f690c4d20a6148d883abe52b2 | Triage

Sharing

General

Target

78b9979f690c4d20a6148d883abe52b2
Size

45KB
MD5

78b9979f690c4d20a6148d883abe52b2
SHA1

6499e58cf6ded711d9b4d6fea34f06ba498b6603
SHA256

942a52980b2fc7f1cd62a00ca6458e368345c9886758bf8d74e47d1c30dc4b5b
SHA512

99bdd1c3d39c5ad516365018e3111775616df75675cae94d072bfc8d5542453abbf3886a3b4bbe6923f3ac8b593ca7f6d9271d3db69fbffb4c363127e97f7594
SSDEEP

768:wJl6Kny22v59UgLoJwmc38c0Lf3krVSoeXkWask:wDNI9jorOYfMeX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
78b9979f690c4d20a6148d883abe52b2

Files

78b9979f690c4d20a6148d883abe52b2
.exe windows:5 windows x86 arch:x86

ce1772065187eaf6f903b17e2f311b10

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TerminateProcess
FindFirstFileA
FindClose
FindFirstFileW
lstrcmpW
GetCurrentProcessId
FoldStringW
GetCommandLineA
MulDiv
LocalSize
GetFullPathNameW
GetLastError
WriteFile
CreateFileW
SetLastError
SetEndOfFile
LocalReAlloc
lstrlenA
HeapAlloc
HeapFree
CloseHandle
VirtualAlloc
GetProcessHeap
GetProcAddress
LoadLibraryA
GetModuleHandleA
WideCharToMultiByte
GetCurrentThreadId

user32

InsertMenuA
GetMenuState

advapi32

RegOpenKeyA

oleaut32

LoadTypeLi

Sections

.text
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 284B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ZECT1
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 508B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ