79d34e85fa52673562bcfdacef02b3c1 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

79d34e85fa52673562bcfdacef02b3c1
Size

72KB
MD5

79d34e85fa52673562bcfdacef02b3c1
SHA1

4e2ca639430e3ece1aed089060481bc0446f2a03
SHA256

1bec7789023a78fbaba4c03b457b0a4d902ecbe54d0848ad3445e0b6ffc1cff1
SHA512

c5b96e703068a130dd5fdd6d0d2e7fb808f68ced1439338912281aa9b4397b0685363351407167e543fac35f37879bdd66f9d504c387009b683ec1c974d2d235
SSDEEP

1536:8mNWyBapHYFdkh9VfMB9du2LBG3GpGHmBt7p:8WHB4H+QXM9vG3GpGHmBt7p

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
79d34e85fa52673562bcfdacef02b3c1

Files

79d34e85fa52673562bcfdacef02b3c1
.exe windows:4 windows x86 arch:x86

ef81b75bedfd0cdf8f0962badabdec81

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapAlloc
GetProcessHeap
GetProcAddress
LoadLibraryW
FreeLibrary
LoadLibraryA
GetLastError
HeapFree
SetLastError
GetVersionExA
lstrcatA
lstrlenA
GetCurrentThread
GetCurrentProcess
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
RtlUnwind
GetModuleHandleA
TlsGetValue
TlsSetValue
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
ExitProcess
LeaveCriticalSection
EnterCriticalSection
Sleep
VirtualFree
VirtualAlloc
HeapReAlloc
WriteFile
GetStdHandle
GetModuleFileNameA
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
InitializeCriticalSection

Sections

.text
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ