79859d11b22e9472a979392dad9f81e9 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

79859d11b22e9472a979392dad9f81e9
Size

14KB
MD5

79859d11b22e9472a979392dad9f81e9
SHA1

4a02a36ef3b9985d495d80e952151a5faf2704e3
SHA256

ba2bf174ce5fc81a1378dfc4a9fe8493577dbd575a50ecc40fe62fa4058d5fa2
SHA512

50958363031cf50196ed67f6eee3080e9a545e60d69443ca1bf21f5a6f226d125eaf771bd88448e7f3d02389aa83b899a60d0dbda118699fd979f7a4dd601e21
SSDEEP

384:+iXpctArPKI+hPZTC9vL1S7k0GuacSmglA1A/+1WK:JXpctArhuA9vL1S7k0GuxG/+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
79859d11b22e9472a979392dad9f81e9

Files

79859d11b22e9472a979392dad9f81e9
.exe windows:4 windows x86 arch:x86

f59a1f406f197de807f5a1ed4f6cd57e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
GetCurrentProcess
GetProcessHeap
FreeLibrary
GetFileAttributesA
CloseHandle
GetProcAddress
SetFilePointer
CreateFileA
lstrlenA
GetModuleFileNameA
PulseEvent
LoadLibraryA
lstrcpyA
CreateEventA
WaitForSingleObject
SetEvent
WriteFile
ExitThread
GetVersionExA
CreateThread
GetTempPathA
ReadFile
ExitProcess
lstrcatA

user32

SetThreadDesktop
ShowWindow
PeekMessageA
CreateWindowExA
TranslateMessage
CreateDesktopA
MsgWaitForMultipleObjects
DestroyWindow
CharToOemA
wsprintfA
EndPaint
DispatchMessageA

Sections

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ