ba0ba30000c0b800b02f9cd2460cb65c | Triage

Sharing

General

Target

ba0ba30000c0b800b02f9cd2460cb65c
Size

33KB
MD5

ba0ba30000c0b800b02f9cd2460cb65c
SHA1

cbcdb73b16033654796c624e8791817f3f041aad
SHA256

58dede0f191f15a0ffa4ce083f48efd029c5e8725ec012d0a47ffffdd9e0d39f
SHA512

c82628063dc481d0527ace8448f5145b0ccfa65280604919224011ef74ea372fd61c64ebb858507e5695fac9a987412e7fdcf35322c4cf26c8c35cfd7a067f50
SSDEEP

384:UYBZe77iR+clh81jAIrqPbllaaU92KZ7lrQ8/FRlDj0SkRIu+rZr0H1dy4SDRbt1:PBZe7e4Zmlla2KZJrQC4iuEqyNRpLeR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

ba0ba30000c0b800b02f9cd2460cb65c

Files

ba0ba30000c0b800b02f9cd2460cb65c
.exe windows:4 windows x86 arch:x86

b705c8fd339cb8a82baa18c96165d8a9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LockResource
SizeofResource
VirtualAlloc
LoadResource
SetLastError
MulDiv
InterlockedExchangeAdd
GetThreadContext
GetModuleHandleA
GetCurrentThread
GetCommandLineA
FindResourceA
lstrlenA
ExitProcess

gdi32

DeleteObject
CreateCompatibleBitmap
SelectObject
DeleteDC
CreateCompatibleDC
BitBlt
GetDeviceCaps

user32

RegisterClassExA
LoadIconA
GetDC
LoadCursorA
GetMessageA
PostQuitMessage
EndPaint
DispatchMessageA
DefWindowProcA
BeginPaint
TranslateMessage

oleaut32

OleLoadPicture

ole32

CoUninitialize
CoTaskMemFree
CoTaskMemAlloc
CoInitialize
CreateStreamOnHGlobal

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ