bde48f298e40c6c3369916bd542c7fb0 | Triage

Sharing

General

Target

bde48f298e40c6c3369916bd542c7fb0
Size

288KB
MD5

bde48f298e40c6c3369916bd542c7fb0
SHA1

70c8d0f24f38e7bdb209ecaa858fd792933b6105
SHA256

c045b638c750fa30d294c83afea66d49476c6502681934a88852b30aaf4a2f67
SHA512

f335c8e5c7ab43967a08ed0b28b8b5a0950c1e9e17802348b63da2125784e74a4132c93aa9540f08e830b6d44f1462d48814b954d23a1f01bc76c78fe7715882
SSDEEP

6144:nHRXBh3z2Er1hbwqxo2hVEpRCGGzjz9NoxMjGcRoUnoRur:HRHlrbFxTVAPG/zgx+W5wr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bde48f298e40c6c3369916bd542c7fb0

Files

bde48f298e40c6c3369916bd542c7fb0
.exe windows:4 windows x86 arch:x86

847fd8ee8bc028ec03b61880124281f9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetModuleFileNameA
CloseHandle
lstrlenA
GetModuleHandleA
GetProcAddress
GetCurrentProcessId

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA

ole32

CoInitializeSecurity
CoCreateInstance
CoUninitialize
CoInitializeEx

shlwapi

StrStrIA

msvcrt

_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
_rmtmp
fclose
fprintf
tmpfile
memset
exit
malloc
rand
_except_handler3
_exit
_XcptFilter
__p___initenv
__getmainargs
_initterm
__setusermatherr

Sections

.text
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 229KB - Virtual size: 228KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ