7e8bffba1b05f7d048273e944a1c943a | Triage

Sharing

Copy URL Twitter E-mail

General

Target

7e8bffba1b05f7d048273e944a1c943a
Size

670KB
MD5

7e8bffba1b05f7d048273e944a1c943a
SHA1

794e762e210bbb0aecef7092476672d62f0f29fc
SHA256

f61e1a24b3f84b89330e2c3c2b9efb9f78d1dc5e587c74b9788b71ac0ed1543d
SHA512

466adad785d641b6e54240a5311863bde1786a9c82c678e99d6c9c12bb67489abb6c87b5c925bf86c6fbb8f95168a5b73973ebf780bc8fcccf749a4f1d31f7e4
SSDEEP

12288:T3pYjvYl/1liD1z+nwbQLhdzQ/Fe89I//IhF81D0KZxSkY+z2T1M/CPf+LXIRaGc:T3fKynWQLvmd9I/K211xQm2CEzC2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7e8bffba1b05f7d048273e944a1c943a

Files

7e8bffba1b05f7d048273e944a1c943a
.exe .ps1 windows:4 windows x86 arch:x86 polyglot

f3485418e438436d337e474a553a8c2d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

version

VerQueryValueA

gdi32

UnrealizeObject

ole32

CreateStreamOnHGlobal

olepro32

OleLoadPicture

comctl32

UninitializeFlatSB

winspool.drv

OpenPrinterA

shell32

Shell_NotifyIconA

msimg32

GradientFill

Sections

CODE
Size: 651KB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE