99e9346ceb0c638f69d296a1dedd771d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

99e9346ceb0c638f69d296a1dedd771d
Size

112KB
MD5

99e9346ceb0c638f69d296a1dedd771d
SHA1

3a626dee8826b38ac4cda2f501e65a457a9a146b
SHA256

cbae5080598e5439c05cfc27cbe6c1135502d7c96953197520c7ffcf2d99c814
SHA512

8fc3b6f35cd55b7bf816de7587d491bc3616df036fed30f6c8900e946b38cab389690d60230443a134865c31ba8944515fd2594978984083f33f07e7d99ab865
SSDEEP

3072:C7e/GsDklFJirRpnadot4UCFtEJ9R1rU+hKfNV/fZ1:C0sDotpBt4rEJnNUb/B1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
99e9346ceb0c638f69d296a1dedd771d

Files

99e9346ceb0c638f69d296a1dedd771d
.exe windows:4 windows x86 arch:x86

be55fd0220ca5cb2694346eec61aa784

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

FindResourceA
LoadResource
LockResource
SizeofResource
VirtualAlloc
GetModuleHandleA
GetProcAddress
WaitForSingleObject
VirtualAllocEx
WriteProcessMemory
LoadLibraryA
VirtualProtect
GetCurrentProcess
CreateThread
GetCommandLineA
GetStartupInfoA

msvcrt

__set_app_type
_controlfp
exit
strstr

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 640B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 106KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ