97aa554ca1f489bc9553de882154bb39 | Triage

Sharing

General

Target

97aa554ca1f489bc9553de882154bb39
Size

515KB
MD5

97aa554ca1f489bc9553de882154bb39
SHA1

bd0b0f6e84dbef3cc77585d1f2531f32c94544b5
SHA256

40189d0f7cc8af2ea8c8fe4ad7e2035cca5f0d95df33c9593ca9619320e74305
SHA512

510d180e55039b8dc6a226efa93f2b3ad6b219845d17eca4c1c8da2d8d8ae444b8f1207e617e60915fa1edadb71f309ed5e52a679de12b219250d2b6c0b11694
SSDEEP

12288:XlZX4AU3yEW3Bnk6zaK76BnAf/g3/2Uv1uY1m1UbSwpSVSFpBgyua:Ds3yXkQS2/qOUv1tuaSVzyH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
97aa554ca1f489bc9553de882154bb39

Files

97aa554ca1f489bc9553de882154bb39
.exe windows:4 windows x86 arch:x86

514d702e813a21114e6d6fe39f022309

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
FormatMessageA
GetLastError
SetLastError
VirtualAlloc
CloseHandle
MapViewOfFile
CreateFileMappingA
VirtualFree
GetProcAddress
VirtualProtect
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
GetModuleFileNameA
GetModuleFileNameW
GetVersionExA
VirtualQuery
SetFilePointer
ReadFile
CreateFileA
UnmapViewOfFile
WideCharToMultiByte
OpenFileMappingA
GetCurrentProcessId
GetProcAddress

user32

MessageBoxA
GetKeyboardType
WindowFromPoint

advapi32

RegQueryValueExA
RegSetValueExA

oleaut32

SysFreeString
SafeArrayPtrOfIndex

gdi32

UnrealizeObject

comctl32

ImageList_SetIconSize

shell32

ShellExecuteA

wsock32

WSACleanup

Sections

.text
Size: 20KB - Virtual size: 549KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE