ab04af6756d16ddd0e20ad326e64edf0 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ab04af6756d16ddd0e20ad326e64edf0
Size

996KB
MD5

ab04af6756d16ddd0e20ad326e64edf0
SHA1

8fcd1a08cf39fec13e795978fe55b772984b1331
SHA256

cffe3047221c62f5b24f23c7395dd8d84afa52ded0b6416525237a098ad91cea
SHA512

bdd3d78b2b86fa830d75be97713504b4022e5e5620f17613bdc5a3c6f3e73cc93726104d7a13aaca5022eb6a09f1c4e2ef74cdd6ea1cab2f099aff54645c71e5
SSDEEP

24576:vVujUwm+OWbDggONNyOwInaF6EKl3Ga2Q/B13tSAhRhvKGH:4jU/Wogoy/DKNGv2B1QarSA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ab04af6756d16ddd0e20ad326e64edf0

Files

ab04af6756d16ddd0e20ad326e64edf0
.exe windows:4 windows x86 arch:x86

e8ae1e5a7111f7ed0180966366d92c23

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

oleaut32

OleTranslateColor
VarI1FromI4

kernel32

ExitProcess
GetCurrentProcess
GetModuleHandleA
GetStartupInfoA
InterlockedIncrement
MultiByteToWideChar
TerminateProcess

Sections

.text
Size: 874KB - Virtual size: 874KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 332B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 113KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 3.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.version
Size: - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ