b4ab3593ee80775f4fb1653b1932bff3 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b4ab3593ee80775f4fb1653b1932bff3
Size

159KB
MD5

b4ab3593ee80775f4fb1653b1932bff3
SHA1

20545858fe88fc5049a26a14a0a5ab359e18a3f0
SHA256

c64e72d1402dccf5f7e998a8e3f31981d066a4ed9079ff5d1b5eb4cff1f6fa49
SHA512

95dfaddad13f41cf0edba1bdbe559e870f9ecb9934e717ed910611223daeb7f3f2704b9921e6d713983838a8d7cb381ea9266a5140e36f450c55488cc9abaa95
SSDEEP

3072:O5i7ZBAjOm3vsW3l5umeXayvIB0CRNZEZi5CI1UhklCRN9K7YKL:O5zqmJl5/pbBlRNZEZiscUrRNAY0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b4ab3593ee80775f4fb1653b1932bff3

Files

b4ab3593ee80775f4fb1653b1932bff3
.exe windows:4 windows x86 arch:x86

f118d10c59ad294fd8cb9a211b97acbe

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStringTypeA
FindResourceA
GetVersion
LCMapStringA
GetUserDefaultLCID
GetLastError
GetVersionExA
IsDBCSLeadByte
GetSystemInfo
LoadResource
IsValidCodePage
LockResource
WideCharToMultiByte
CreateProcessA
GetACP
IsBadWritePtr
CloseHandle
SizeofResource
MultiByteToWideChar
GetOEMCP
GetModuleHandleA

user32

LoadCursorA
LoadStringA
TranslateMessage
GetMessageA

oleaut32

VariantClear
VariantChangeType
VariantInit
VariantCopy
VarUI4FromStr

Sections

.text
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 800B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ