a188892d8e69f7e7d1ed6a83dc0128da | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a188892d8e69f7e7d1ed6a83dc0128da
Size

384KB
MD5

a188892d8e69f7e7d1ed6a83dc0128da
SHA1

931ed3e2a97cf97c51c4a87ac02457f16eb1ae3f
SHA256

e19d0a6572c81640f54c7418fd04878fbaf58a276caf88363f87ef7288536035
SHA512

67e5424f0e566c362e5abf57872778f6484fdb4a119c29fd0ea3ee0ba94b936851911a5f08defe362604471120e94c92af573fe222cc2e0bb99ecfadeca7b6fd
SSDEEP

6144:v/ORdVLaiAmnsojwkyHlX93hU3mToDUBnsCiRD:v/ORrL0yjw7Hl9S2TjBsCiR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a188892d8e69f7e7d1ed6a83dc0128da

Files

a188892d8e69f7e7d1ed6a83dc0128da
.exe windows:4 windows x86 arch:x86

f969b63f574577e1f1f26f23a75367f2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
GetCurrentThreadId
ExitProcess
SetFileApisToANSI
GetModuleFileNameA
GetSystemDirectoryA
GetModuleHandleA
HeapCreate
VirtualFreeEx
ReleaseSemaphore
ResetEvent
VirtualFree
GetProcAddress
Sleep
GlobalLock
GetSystemTime
SetEvent

user32

GetWindowInfo
GetWindow
PostMessageA
ShowWindow
EnumChildWindows

advapi32

CopySid
AddAce

shell32

SHGetFolderPathA

ole32

CoUninitialize

psapi

GetWsChanges

avifil32

AVIStreamCreate

msvfw32

ICGetInfo

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 336KB - Virtual size: 332KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 8KB - Virtual size: 422KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ