aa1ac6a0e87f1a50e5be9e73d66d2e87 | Triage

Sharing

General

Target

aa1ac6a0e87f1a50e5be9e73d66d2e87
Size

122KB
MD5

aa1ac6a0e87f1a50e5be9e73d66d2e87
SHA1

3eca2bd24871a470ec0851f5fa72d11da34bb85f
SHA256

095a30de149aef0a743da54b5491fe695a5694a35d4565cd1e66843d7c9ef261
SHA512

c30a7033fe6aea78954191a5efb162fd96d136de95220205269b2e79e993bd8aceae51821773a66f4877eefbb71d3c3a244f3d8078f870d443bd5bd52a7dcf0d
SSDEEP

1536:TUPN2o5nBQQz5uUrVqP9C3eKgVME6ppIFgU8Ws:wlduP+wMfpISh3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aa1ac6a0e87f1a50e5be9e73d66d2e87

Files

aa1ac6a0e87f1a50e5be9e73d66d2e87
.dll windows:4 windows x86 arch:x86

5ed6dc498cc00bfa94f102d6ae729bc5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Documents and Settings\skjung2\My Documents\Visual Studio Projects\FunBox\$$$\MCPTB\Release\MCPTB.pdb

Imports

mfc71lu

ord1093
ord371
ord1168
ord762
ord1079

mslur71

_onexit
__dllonexit
__CppXcptFilter
_adjust_fdiv
malloc
_initterm
__security_error_handler
memset
_except_handler3
free

kernel32

InitializeCriticalSection
DeleteCriticalSection
GetVersionExA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
ExitProcess

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 60KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 546B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 168KB - Virtual size: 168KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE