c461135a04bc10985b24d17cbf8aa57c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c461135a04bc10985b24d17cbf8aa57c
Size

67KB
MD5

c461135a04bc10985b24d17cbf8aa57c
SHA1

7dcf939c6d6da89459329dcab4822511d4cd5c42
SHA256

87439f35d025160bffb2c9bbb6a0da129693d1384cca54f2a01cefd2b204649a
SHA512

9a6b6a4b5e80cbda7b02af4fead9bfc7999fde7cfb12f5f6f60fa6e3a7bae8cfb3d45e03123f19a5c80042534184e3c48494efe87300a186d0837774ac28e9be
SSDEEP

1536:5Jpmwd+pdg7EHn9KCGga4EAkiu8LZ18hND8wd2QSQ3:RmPjg709pGgPENiJLZ1SN4NI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c461135a04bc10985b24d17cbf8aa57c

Files

c461135a04bc10985b24d17cbf8aa57c
.exe windows:4 windows x86 arch:x86

ceead6cc09c2dd462365c5a159e6951e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualProtect
HeapAlloc
GetFileAttributesA
lstrcpyA
VirtualAlloc
CloseHandle
WaitForSingleObject
lstrcmpiA
HeapReAlloc
GetFileSize
GetFileAttributesW
SetEvent
GetModuleFileNameW
GetVersionExW
GetProcAddress
CreateProcessW

shlwapi

wnsprintfW
PathCombineW
PathRemoveFileSpecW
PathFileExistsW
SHDeleteKeyA
wvnsprintfA
StrCmpNIA
wnsprintfA
PathMatchSpecW
wvnsprintfW
StrStrW
StrCmpNIW

user32

FindWindowExA
SendMessageA
GetDlgItemTextA
GetWindowLongA
CharLowerBuffA
CloseWindowStation
GetKeyboardState
ExitWindowsEx
DrawIcon
GetForegroundWindow
GetClipboardData
LoadCursorA
GetKeyState
GetDlgItem

advapi32

CryptCreateHash
RegCreateKeyExA
CryptReleaseContext
RegSetValueExA
RegEnumKeyExA
CryptAcquireContextW
CryptHashData
CryptGetHashParam
RegCloseKey
RegQueryValueExA
GetUserNameW
DuplicateTokenEx
RegDeleteValueA

Sections

.text
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE