General

  • Target
    a7e83a966721691aee8f57fd5cce3c90
  • Size 1.4MB
  • Sample240227-b8d7kaea21
  • SHA256 8c576d63eb9a7078f1a1eed320fa0ec6c660ca48002ae28c8699551428c12d50
  • MD5 SHA1 SHA512 SSDEEP
Score
3/10

Malware Config

Signatures

  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • a7e83a966721691aee8f57fd5cce3c90
    .exe 1.4MB
  • .data
    1024B
  • .rsrc/1033/AVI/3001
    11KB
  • .rsrc/1033/DIALOG/2001
    754B
  • .rsrc/1033/DIALOG/2002
    432B
  • .rsrc/1033/DIALOG/2003
    358B
  • .rsrc/1033/DIALOG/2004
    448B
  • .rsrc/1033/DIALOG/2005
    304B
  • .rsrc/1033/DIALOG/2006
    288B
  • .rsrc/1033/GROUP_ICON/3000
    132B
  • .rsrc/1033/ICON/1
    .png 15KB
  • .rsrc/1033/ICON/2.ico
    66KB
  • .rsrc/1033/ICON/3.ico
    16KB
  • .rsrc/1033/ICON/4.ico
    9KB
  • .rsrc/1033/ICON/5.ico
    6KB
  • .rsrc/1033/ICON/6.ico
    4KB
  • .rsrc/1033/ICON/7.ico
    2KB
  • .rsrc/1033/ICON/8.ico
    1KB
  • .rsrc/1033/ICON/9.ico
    1KB
  • .rsrc/1033/MANIFEST/1
    .xml 1KB
  • .rsrc/1033/RCDATA/ADMQCMD
    7B
  • .rsrc/1033/RCDATA/CABINET
    .cab 1.3MB
  • Chi.accdb
    685KB
  • Ero.accdb
    634KB
  • Gambe.accdb
    872KB
  • Tutti.accdb
    468B
  • .rsrc/1033/RCDATA/EXTRACTOPT
    4B
  • .rsrc/1033/RCDATA/FILESIZES
    36B
  • .rsrc/1033/RCDATA/FINISHMSG
    7B
  • .rsrc/1033/RCDATA/LICENSE
    7B
  • .rsrc/1033/RCDATA/PACKINSTSPACE
    4B
  • .rsrc/1033/RCDATA/POSTRUNPROGRAM
    25B
  • .rsrc/1033/RCDATA/REBOOT
    4B
  • .rsrc/1033/RCDATA/RUNPROGRAM
    12B
  • .rsrc/1033/RCDATA/SHOWWINDOW
    4B
  • .rsrc/1033/RCDATA/TITLE
    6B
  • .rsrc/1033/RCDATA/UPROMPT
    7B
  • .rsrc/1033/RCDATA/USRQCMD
    7B
  • .rsrc/1033/string.txt
    6KB
  • .rsrc/1033/version.txt
    1KB
  • .rsrc/1049/string.txt
    6KB
  • .text
    38KB
  • CERTIFICATE
    9KB

a7e83a966721691aee8f57fd5cce3c90

  • IMPHASH 0ebb3c09b06b1666d307952e824c8697
  • SHA256 8c576d63eb9a7078f1a1eed320fa0ec6c660ca48002ae28c8699551428c12d50
  • MD5 SHA1 SHA512 SSDEEP
  • Unsigned PE

    Checks for missing Authenticode signature.

Minor OS version
1
Major OS version
5
Entry point
25692
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE
PDB paths
wextract.pdb