ab5609adff9917d517f6de6e823059d5 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ab5609adff9917d517f6de6e823059d5
Size

20KB
MD5

ab5609adff9917d517f6de6e823059d5
SHA1

f34e6374834debb278c6db074782d847c96ac22e
SHA256

e95fd80009fc8c1da52c9711da104a328302f5a494fb633f2f847f71264217d3
SHA512

3827022939ef4edc7a4a8f1b32323626d89f1b0562ad1398345a963396922acd1bad0fd3453a7266a5a25e5025d2a12096a1b9ff9e081e5920f7eaa004ff3d16
SSDEEP

192:4LSqa5lDd2xnIPex/hsYO7f24Jl+iRT11dHaHRH4HD07+Z:4WqolDEZaYEf9CiNJUpK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ab5609adff9917d517f6de6e823059d5

Files

ab5609adff9917d517f6de6e823059d5
.exe windows:4 windows x86 arch:x86

27017f173055a24fd9cc53254ecb4c0b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTempPathA
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapFree
IsBadReadPtr
DeleteFileA
CloseHandle
WaitForSingleObject
CreateProcessA
GetStartupInfoA

shell32

SHGetPathFromIDListA
SHGetSpecialFolderLocation

urlmon

URLDownloadToFileA

user32

wsprintfA
MessageBoxA

Sections

.text
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 614B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE