bf881eb56a8c0130470774760fabb30e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bf881eb56a8c0130470774760fabb30e
Size

270KB
MD5

bf881eb56a8c0130470774760fabb30e
SHA1

54e4038ede87813deab9c017c2bc772862832ef4
SHA256

d6e0432deb057ccadba8a6efd837bf0434295c0fcad95e4d39492225cb88fac1
SHA512

b6323b21f5b36d0e41b5b9be1b0ad72424024a45b374fd71fbb5947e4fc86cfab4861826bdaf2ab0091a7d0e2a0923a6db80c808b223c94db4fb3d46d089aabc
SSDEEP

6144:HjAwZ03+I2xN/LsjNaF9nOHA1/gtxq4C6VCywqF:DFlKMOHAdgD9Cu22

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bf881eb56a8c0130470774760fabb30e

Files

bf881eb56a8c0130470774760fabb30e
.exe windows:4 windows x86 arch:x86

c9388cc0729b931847a03e83d44a906d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

ExitProcess
ReadConsoleA
ExpandEnvironmentStringsW
SetConsolePalette
GetProfileIntA
LeaveCriticalSection

user32

GetWindowContextHelpId
CreateDesktopW
EqualRect
MonitorFromPoint
DlgDirSelectComboBoxExA
ReasonCodeNeedsBugID
PrivateSetRipFlags
MonitorFromWindow

ws2_32

WSAStartup
WSARecv
setsockopt
WSAAsyncGetProtoByName
WPUCompleteOverlappedRequest

shell32

SheGetCurDrive
SHDefExtractIconW
DAD_DragLeave
ShellMessageBoxA
ILCreateFromPath
StrNCpyA
DuplicateIcon
SHCreateShellFolderViewEx

gdi32

GetStringBitmapW
CreateDIBPatternBrushPt
SetBkMode
CloseFigure
GetTextCharset

Sections

.text
Size: 267KB - Virtual size: 268KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 536KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ