994e80f5ca49ca13bb7f19e57527f29e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

994e80f5ca49ca13bb7f19e57527f29e
Size

208KB
MD5

994e80f5ca49ca13bb7f19e57527f29e
SHA1

895a85220f3990eed1a1142f7cc5ac13b60cc4d9
SHA256

ecf2232d5e1398701c1a5d313addcd8facfc5e40034b10d9fd90c8c42fc7408c
SHA512

70ce4aa49d4ed0a34b5ba260d1c33104ddebf486712508a65b7201779843022f0ae2654c7e0fd0bf532ec7d9ff86cb69c80fa46221e1b8a7429bed712b7c4fb8
SSDEEP

6144:Xl2/rrHkhwUiFOB8AjW3IBjPAlHVZbDA8NTt:Ena4uRjSI1AtVZHAw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
994e80f5ca49ca13bb7f19e57527f29e

Files

994e80f5ca49ca13bb7f19e57527f29e
.exe windows:4 windows x86 arch:x86

691f1193f16065947032ace3a2329e55

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

msvcrt

fabs

comctl32

InitCommonControls

user32

IsChild

gdi32

BitBlt

ole32

CoInitialize

shell32

ShellExecuteExA

shlwapi

PathQuoteSpacesA

Sections

.MPRESS1
Size: 203KB - Virtual size: 752KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE