add0cd21fd0972e6691939b0bb2114ef | Triage

Sharing

Copy URL Twitter E-mail

General

Target

add0cd21fd0972e6691939b0bb2114ef
Size

2.0MB
MD5

add0cd21fd0972e6691939b0bb2114ef
SHA1

8592500dd6d45e130b3823de3ea8e84231f81c52
SHA256

40e656a35d4b509786b52ca3109edf6293345799cdf8e882860777ca5e6d128f
SHA512

cb73fd52dddf7b0be727e3b43273dc7ef0cda3a0cb1fee3077d4e3e081beea1f59013523fe4cb07e333c828dee07538429d9acc4c7cb2a76643082f6779176eb
SSDEEP

49152:KbOj7yW9TcM4eJ7SU1y9eMedMRnQGZ21bZAmueS8YoPv:KbEpcMjJ7SU10eNdM9QGIZZy8nn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
add0cd21fd0972e6691939b0bb2114ef

Files

add0cd21fd0972e6691939b0bb2114ef
.exe windows:4 windows x86 arch:x86

e93715b7f66ad0688e5e9d8f4151e592

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

ord698
ord593
ord598
ord631
ord525
ord526
EVENT_SINK_AddRef
ord529
DllFunctionCall
EVENT_SINK_Release
ord600
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord712
ProcCallEngine
ord645
ord570
ord648
ord578
ord100
ord617
ord581

Sections

.text
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ