97cbd8b423fdd53d1a1a0849bf9a4eb8 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

97cbd8b423fdd53d1a1a0849bf9a4eb8
Size

191KB
MD5

97cbd8b423fdd53d1a1a0849bf9a4eb8
SHA1

df30172596c625d4af7b281e25bcd294c432958d
SHA256

271e1b3e738eb221a0c79e360b99c68eccf17dcf8c40be82fdb88715cf03db87
SHA512

3349cfd15a06f731ca85510897c7c85e6ea6e23725eb2916b516c1f6c7231340d9b2c888e820873a4d4c11ea0d048997c9c7c0ca487b0f18fc13db822ff755fe
SSDEEP

3072:Q8l++kjP5uCkDilwN9gVRfb7BUR59OFbgqHUsiJByNXkkQypxSfcI:QurkDkilxDf3SRTODUxb6zQypxWcI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
97cbd8b423fdd53d1a1a0849bf9a4eb8

Files

97cbd8b423fdd53d1a1a0849bf9a4eb8
.exe windows:4 windows x86 arch:x86

2def80e33554c9fa7ba605b5986c9ebe

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

bind
WSAStartup
listen

kernel32

CreatePipe
TerminateProcess
VirtualProtect

gdi32

SetRelAbs
StretchBlt
SetICMMode
ResetDCW
UpdateColors
SaveDC
TextOutW
SetDIBColorTable

shell32

SHAppBarMessage
StrRChrIA
StrStrIA

Sections

.text
Size: 31KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 140KB - Virtual size: 729KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ