c17566b5a29ab40e4e7c050a4f56c496 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c17566b5a29ab40e4e7c050a4f56c496
Size

122KB
MD5

c17566b5a29ab40e4e7c050a4f56c496
SHA1

f0fd136c50f5eb354a455760fd794a828659265c
SHA256

e930fbebc8aa27e3e941904139936148bab4861de89fa43030ee53f2fb9f86f7
SHA512

19b0b4c5a45668d19e0d74972b402c4b034ad8e7121139b0296b8d1af7308cdd765783e1e98da80d50a04cf02560e15be9797a5998c041cb529d20b56bddcf9e
SSDEEP

3072:DZIUJLm1Jn5ajG829kTMw4HZE6smDFxSCLf1s8xusE9G:FL2QG829kTqHZEMFx9L95u10

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c17566b5a29ab40e4e7c050a4f56c496

Files

c17566b5a29ab40e4e7c050a4f56c496
.exe windows:4 windows x86 arch:x86

61c3cc26f53cc96cd6fbce8ece05b193

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileA
DeviceIoControl
ExitProcess
GetConsoleOutputCP
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetTickCount
InitializeCriticalSection
InterlockedExchange
IsDebuggerPresent
LoadLibraryA
LockResource
ResetEvent
TlsAlloc
VirtualAlloc
VirtualFree

user32

IsWindowVisible
PostMessageA
ReleaseDC

gdi32

CreateBrushIndirect
DeleteEnhMetaFile
ExtTextOutA
SaveDC
SetViewportOrgEx
StretchBlt
TextOutA

Sections

.text
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 815B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ