036e48bc428237cda45e8ed687a7bc04371b484c345a166dfd50e3bff5b28a66 | Triage

Sharing

General

Target

036e48bc428237cda45e8ed687a7bc04371b484c345a166dfd50e3bff5b28a66
Size

279KB
MD5

bec12b59a1f6396476b0b56bdf37a2d8
SHA1

a42a07a7ca2b2486f0e3c4554401c19243383bd4
SHA256

036e48bc428237cda45e8ed687a7bc04371b484c345a166dfd50e3bff5b28a66
SHA512

9325324314e2028661441ddc25f414aef83dfd7dcbd6adacdfb6f789f34634f12e90d30444048302b3bb63cdf0eb219629d037124a54fec6b1e5003aa4de450e
SSDEEP

6144:kn5jzAWmB/lkHai8y38jfM9kTZnXqbvOvbGOWhGGtebfKphGS7S2s1gBdl:kn5j8Ww/ly36v9n6bvVOWhG1eph+9Q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
036e48bc428237cda45e8ed687a7bc04371b484c345a166dfd50e3bff5b28a66

Files

036e48bc428237cda45e8ed687a7bc04371b484c345a166dfd50e3bff5b28a66
.exe windows:4 windows x86 arch:x86

64b74622fcc5af1bd01c654243701d2f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalAddAtomW
WriteFile
HeapAlloc
SetFilePointer
ExitProcess
VirtualQuery
GetOEMCP
GetSystemInfo
EnumResourceNamesW
VirtualProtect
SetEndOfFile
GetStringTypeExW
GetCurrentProcess
ReadFile
FlushFileBuffers
HeapFree
RtlUnwind
FindAtomW

winspool.drv

OpenPrinterW
ClosePrinter
DocumentPropertiesW

comdlg32

ChooseFontA
GetOpenFileNameA

ole32

CoTaskMemFree
CLSIDFromString
CoCreateInstance
StgCreateDocfile

setupapi

CM_Get_Depth
CMP_WaitNoPendingInstallEvents
SetupDiGetDeviceRegistryPropertyW
CM_Get_DevNode_Status

Sections

.text
Size: 147KB - Virtual size: 278KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 129KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ