b9b998aebe16472e1b6f2bfe523b20e2 | Triage

Sharing

General

Target

b9b998aebe16472e1b6f2bfe523b20e2
Size

343KB
MD5

b9b998aebe16472e1b6f2bfe523b20e2
SHA1

fc3a19ebf7e3d8d04ee127bb296493a22993975c
SHA256

21ec84e64dc6ed088e4449b9a8023c01e58202d880e8d6d9556007d945bf956c
SHA512

6a265adb1a02486330f1332bd2d6a55da6f91637c22f775d0a096b983c7f44d656f94e07e271410153e5df0201ceb54bcd66f088a729234da9773cc56415b4c7
SSDEEP

6144:7HSqsvPol4NaOFflI6k74E56Ab4hUuVRjG3WOL+b7HiTddQv2t:7yVol4Nk6k71hbCUicN+SdMI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b9b998aebe16472e1b6f2bfe523b20e2

Files

b9b998aebe16472e1b6f2bfe523b20e2
.exe windows:4 windows x86 arch:x86

e920e23e4cbe799d451ce4ba4338ee4a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetUserDefaultLangID
FindClose
FindFirstFileW
GetLocaleInfoA
GetVolumeInformationW
GetFullPathNameW
CreateFileW
SetErrorMode
GetVersionExW
FileTimeToLocalFileTime
GetFileAttributesW
GetFileTime
HeapFree
HeapAlloc
GetProcessHeap
RtlUnwind
HeapValidate
IsBadReadPtr
RaiseException
ExitProcess
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetSystemTimeAsFileTime
FreeEnvironmentStringsA
GetStdHandle

msvcrt

_initterm
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
exp
__setusermatherr
_stricmp
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_onexit
__dllonexit
?terminate@@YAXXZ
_except_handler3
_makepath
_wmakepath
wcscmp
wcscpy

msimg32

TransparentBlt

Sections

.text
Size: 154KB - Virtual size: 154KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ