99dc402adc509b84e3b64821ad6ad543 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

99dc402adc509b84e3b64821ad6ad543
Size

174KB
MD5

99dc402adc509b84e3b64821ad6ad543
SHA1

14a206452efd0af3b01dac48d3ddae2db11c390a
SHA256

494227fd573946e852fecdf79334670d3b2bcf4529f880e05ef098c63d32b955
SHA512

0efd3ebeacbf9a255c37eddf4b22486c1de6dda752adaf170c85c8748adddd61f8275140457682bc546fbe4edf4b6b697a38d404472b8143c5e22f0763dbbf05
SSDEEP

3072:xMvNgSTYRrKTA7Y2ZVMdohS8VU1NEm60qkqL3r5QP4Xj6+/DsVdr3V:ON7kVOA7FNgo/m9iyQ++bC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
99dc402adc509b84e3b64821ad6ad543

Files

99dc402adc509b84e3b64821ad6ad543
.exe windows:4 windows x86 arch:x86

4ddc9f4612edd05cda035f5d3475c790

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

version

VerQueryValueA

gdi32

UnrealizeObject

ole32

CreateStreamOnHGlobal

comctl32

ImageList_SetIconSize

wininet

FindNextUrlCacheEntryA

shell32

SHGetSpecialFolderPathA

Sections

CODE
Size: 166KB - Virtual size: 480KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE