636883b84e03a8bf741ca38a6b1bd4b946167e4101346238ea828f99bb53fad5 | Triage

Sharing

General

Target

636883b84e03a8bf741ca38a6b1bd4b946167e4101346238ea828f99bb53fad5
Size

171KB
MD5

be828617564d7664daaf2a44dde64605
SHA1

8e78b1a95bb133b42f30badb317b0a7d7f8a6dca
SHA256

636883b84e03a8bf741ca38a6b1bd4b946167e4101346238ea828f99bb53fad5
SHA512

53d32e7816cc41b28d2d142bea22a628fe1e92f87a8c67981ea2915fb3bf02d8962e44730778f0414aa9376b7ef3c6a75549e4fd029dea20baacee1ae2d66576
SSDEEP

1536:s9SsmEuUQ0/Siir+jJuCGEvkznmP+upxEJcoLN4LZ8BSaPXDe7:uT/NbGEv8mWupxEKoBuiB/XDm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
636883b84e03a8bf741ca38a6b1bd4b946167e4101346238ea828f99bb53fad5

Files

636883b84e03a8bf741ca38a6b1bd4b946167e4101346238ea828f99bb53fad5
.exe windows:4 windows x86 arch:x86

b52f1898b4b003f762f5b9c03e005e8a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

wsprintfA
MessageBoxA
GetClassNameA
IsWindowVisible
GetAsyncKeyState
GetWindow
GetWindowThreadProcessId

kernel32

ReadFile
LCMapStringA
LoadLibraryA
FreeLibrary
Sleep
GetLocalTime
GetStartupInfoA
CreateProcessA
OpenProcess
GetModuleHandleA
GetProcAddress
ReadProcessMemory
CreateRemoteThread
VirtualFreeEx
CloseHandle
WaitForSingleObject
GetExitCodeThread
VirtualProtectEx
WriteProcessMemory
CreateToolhelp32Snapshot
Module32First
CreateThread
OpenEventA
CreateEventA
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetModuleFileNameA
WriteFile
GetFileSize
CreateFileA
MoveFileA
DeleteFileA

msvcrt

malloc
_CIfmod
_CIpow
strchr
realloc
memmove
__CxxFrameHandler
sprintf
strncpy
atoi
??3@YAXPAX@Z
strncmp
??2@YAPAXI@Z
modf
_ftol
free

Sections

.text
Size: 151KB - Virtual size: 151KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 672B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ