b9213604126b7a3d72a32fff1d75c6c8 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b9213604126b7a3d72a32fff1d75c6c8
Size

130KB
MD5

b9213604126b7a3d72a32fff1d75c6c8
SHA1

6208040610b54eb7a139d397eb65d31a16e58a4d
SHA256

6dcb2eb6ad7760e728d3355837dd5498c2cafc47017259c6f6ef64b26a5e431d
SHA512

794d07f88d3de402332918e2e25e6ddc39f6bc210411ccb9aae2230bd738250ca5c2ee528f8cd5c141134e501543c5e40ffb64d83ea6a7f54c0274a08c2af20a
SSDEEP

3072:CkqzeMRMd3gZkjIVK4aEo9qG7QJ5wC5wV91uHdmcRWiuGuQb:T0eRqkW3nG8JiC5K90Hdbb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b9213604126b7a3d72a32fff1d75c6c8

Files

b9213604126b7a3d72a32fff1d75c6c8
.exe windows:5 windows x86 arch:x86

e87cd671af1980917871da49e9bf17e2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

DbgPrint
vsprintf
memset
memcpy
RtlUnwind

kernel32

HeapAlloc
SetUnhandledExceptionFilter
GetProcessHeap
GetProcAddress
GetModuleHandleA
ExitProcess
ResumeThread
SetProcessShutdownParameters

user32

UpdateWindow
MessageBoxW
CreateWindowExW
ShowWindow
DefWindowProcW
DispatchMessageW
RegisterClassExW
TranslateMessage
BeginPaint
PostQuitMessage
GetMessageW
DestroyWindow
EndPaint
LoadStringW

gdi32

AbortDoc

winspool.drv

ClosePrinter
OpenPrinterA

comctl32

ord17

Sections

.text
Size: 127KB - Virtual size: 127KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ