9a39ea576cd3892ce3532bceb2a57214 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

9a39ea576cd3892ce3532bceb2a57214
Size

168KB
MD5

9a39ea576cd3892ce3532bceb2a57214
SHA1

5f8d8a3783586a8ac7076f2f8cb9a5b765c1c439
SHA256

2456f5d93abdbd5a0652142efd22aafe81ea9abbaa38725383fbcd120215a6bb
SHA512

7a4d9114e8bdd74332cecb956e8598df4535cdd1f3a3c7fc3cfd51586be66ccac8380edafb2e89afb5cfcef8c6d6bc27e816ca1ba0de376565fe31d7cac8fae3
SSDEEP

3072:z1N1vRulgT1VR1gVCJnwaG+7fuwVDJ7FUm24BkKEAKen83p3HmtZUmN/D2ueC:pRumT1VR1gVCpwaG+7bDfxCK585HSUmL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9a39ea576cd3892ce3532bceb2a57214

Files

9a39ea576cd3892ce3532bceb2a57214
.exe windows:5 windows x86 arch:x86

ca4a9c4d91429eee005cc1d0035a7e3d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

K:\mgresmecz\yStnQAeNKzSwE\iuQkzrgmj\ItbihvWjlEjf.pdb

Imports

kernel32

GetHandleInformation
GetFullPathNameW
GetModuleFileNameW
CreateWaitableTimerA
HeapWalk
HeapUnlock
SetThreadAffinityMask
GetACP
GetProfileIntW

shlwapi

PathUnquoteSpacesA

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

user32

MessageBoxA

gdi32

FillRgn
DeleteObject
AddFontResourceW
CreateRectRgn

Exports

Exports

?MyDataFunc@@YGKXZ

Sections

.text
Size: 118KB - Virtual size: 117KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.debug01
Size: - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ