c21bf83ca7a7ee0cf4889589f275d16a | Triage

Sharing

General

Target

c21bf83ca7a7ee0cf4889589f275d16a
Size

316KB
MD5

c21bf83ca7a7ee0cf4889589f275d16a
SHA1

57fde7666e168cfcae22e3d1ee655766efc0b412
SHA256

841b22734fe41e2c8ac1de6fdf1f4a001e7992b4c4a33d057b222e21e286f1cc
SHA512

cf95ff52f4d1f9622c1360ae6499fcd34f6696e66057f516aa2a917647ca1bf099fa5b8a5f881b12373c80df04ea25ca481fde7c0cc30e0b1bb4281831593b77
SSDEEP

6144:YYMXAavPpr2FH4rmKovokL4M10kgSvvaahzSM+hxxj8dyR/ZP6f:YY1urcYaKNW3aaJGhxYGRif

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c21bf83ca7a7ee0cf4889589f275d16a

Files

c21bf83ca7a7ee0cf4889589f275d16a
.exe windows:4 windows x86 arch:x86

ffced5882caa44b08dd989f7f365459b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetProcAddress
GetModuleHandleA

user32

CharNextA

advapi32

RegCloseKey

oleaut32

SysFreeString

ole32

OleInitialize

pstorec

PStoreCreateInstance

rasapi32

RasEnumEntriesA

shell32

SHGetSpecialFolderPathA

crypt32

CryptUnprotectData

Sections

.MPRESS1
Size: - Virtual size: 340KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 972B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE