aa89b498a6ffd863949a50667bfef86b | Triage

Sharing

General

Target

aa89b498a6ffd863949a50667bfef86b
Size

58KB
MD5

aa89b498a6ffd863949a50667bfef86b
SHA1

e8014da560006f231df86e68404f14b940111b25
SHA256

7f69cd2cb56c4f75ebd67032fd2e0dc76f8eeeea34d892ee3bfbd690fc59ef7f
SHA512

ba7c29fe3e672286689a1f19467cad7a56647f4bfa5d80674ce82971f62b482d419219825db42395e9866d005060bf79bb79564ab30b1b3c4f5bb59b07f9966f
SSDEEP

1536:vvwawSD6p286/jJ+0TjQgU3iIcWKAhDLHz:vvwWD6p6/9PIcAhDLT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aa89b498a6ffd863949a50667bfef86b

Files

aa89b498a6ffd863949a50667bfef86b
.exe windows:4 windows x86 arch:x86

233d43c85d3e6d8c909589d1c7274413

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

SetCursor
LoadImageA
GetMessageA
DrawTextA

kernel32

SetEndOfFile
lstrcmpA
WriteFile
VirtualAlloc
TlsSetValue
EnterCriticalSection
EnumResourceLanguagesA
EnumResourceNamesA
GetModuleHandleA
GetStartupInfoA
LoadLibraryA
Sleep

ole32

CoInitializeSecurity
OleCreateLink
WriteClassStg
CoGetCurrentProcess

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

code
Size: 18KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 34KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE