acf4e874725e648d2e2f6ce9487c834e | Triage

Sharing

General

Target

acf4e874725e648d2e2f6ce9487c834e
Size

1.0MB
MD5

acf4e874725e648d2e2f6ce9487c834e
SHA1

11db79e3dc3b4801f0928c8ba4d61de0042a6fe5
SHA256

04f111b7ad0addeeee15f401c5bc0f9891ab9f9ece28328b4e72f818d369c616
SHA512

8625fe24877e01efc5a32d3c8693edc44c3dc494f350cfae54938dadd1e4c81bc7ae6069a8a5c18cfa925c81f2e1a8eb2ccd0229dc64e447d4da1592e441269b
SSDEEP

24576:xGO0dwk6fod45liqIz7Qm7fiPMV5cbu0WU:xGzH6Adelyfl/5cbuO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
acf4e874725e648d2e2f6ce9487c834e

Files

acf4e874725e648d2e2f6ce9487c834e
.exe windows:4 windows x86 arch:x86

8e4b6760aeaddd01ae7334780c95724e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetProcAddress
LoadLibraryA
GetVersion
lstrcatA
GlobalFree
CreateEventA
GetModuleHandleA
GetTickCount

gdi32

CreateSolidBrush
BitBlt
GetTextExtentPoint32A
DeleteObject
GetObjectA
GetPixel
GetBkColor
ExtTextOutA
SetROP2
CreateFontIndirectA
PatBlt
GetStockObject
CreateCompatibleDC
GetDeviceCaps
LineTo
SetPixel
SetBkMode
MoveToEx
GetTextMetricsA

Sections

.text
Size: 1024B - Virtual size: 953B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 1012B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1018KB - Virtual size: 2.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ