1b9a6ff07292901abad1986d7f196b49b1319075cc7cb5d0152710b8ad751011 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1b9a6ff07292901abad1986d7f196b49b1319075cc7cb5d0152710b8ad751011
Size

12.1MB
MD5

00aaf17288dd954ed7576bcc48670984
SHA1

e6a8af070fd79aed5f4cac3c5e44d8a089952986
SHA256

1b9a6ff07292901abad1986d7f196b49b1319075cc7cb5d0152710b8ad751011
SHA512

0083a398ebaf62db9472b2890c7f51182aa01309c797fd0ddab80dcec5b6c003aaed3b2b9f17e9212e2a820ca45dceceebdc93c6db4d1016f9e4711b874a7185
SSDEEP

393216:PbhMlApEV+qJBbgX7DbqexXJAe40sErfqi9UY:Pd6ApEiX7DTxZ28qI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1b9a6ff07292901abad1986d7f196b49b1319075cc7cb5d0152710b8ad751011

Files

1b9a6ff07292901abad1986d7f196b49b1319075cc7cb5d0152710b8ad751011
.exe windows:4 windows x86 arch:x86

663810e1fa5b87d94b50c2209a69a4b6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

rasapi32

RasHangUpA

winmm

midiStreamRestart

ws2_32

select

user32

wsprintfA

gdi32

ExtSelectClipRgn

winspool.drv

OpenPrinterA

advapi32

RegQueryValueA

shell32

ShellExecuteA

ole32

CoGetClassObject

oleaut32

SafeArrayAccessData

comctl32

ImageList_Duplicate

oledlg

ord8

wininet

InternetCanonicalizeUrlA

comdlg32

ChooseColorA

Sections

.text
Size: 3.9MB - Virtual size: 5.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE