c639ab24a32a7d0d06be6d8b4e3e3ff5 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c639ab24a32a7d0d06be6d8b4e3e3ff5
Size

104KB
MD5

c639ab24a32a7d0d06be6d8b4e3e3ff5
SHA1

0c29e02182d46968d556d23f2982f4cf2c8d1fcb
SHA256

50c2ec8121e4623ffcb6ee0416709dd7eb02a2bded58f1ad41b851764d9b11fc
SHA512

c14ca5fb1b9730070b67efbc2a664693836c92f7613065d32a75b14ae051b733c85d2d1b88b99f397636f23dd886aaa41902254b68fb71d08440bf05d0006967
SSDEEP

3072:ZZ9nWlFIXvnNJwN8Hr76BIZjKqnOwV/23WlWpGk:Fn0IfnNJwN8L7wSZnOS23Wl6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c639ab24a32a7d0d06be6d8b4e3e3ff5

Files

c639ab24a32a7d0d06be6d8b4e3e3ff5
.exe windows:4 windows x86 arch:x86

6f890fd251de5970e09f298d83a737f3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

GetUrlCacheEntryInfoA
FtpCreateDirectoryW
GopherGetAttributeA
IncrementUrlCacheHeaderData
InternetCombineUrlA
FtpGetFileA

urlmon

DllGetClassObject
CoInternetCreateSecurityManager
HlinkGoForward
URLOpenPullStreamW
BindAsyncMoniker
URLOpenStreamA

user32

CopyRect
CallMsgFilterA
AdjustWindowRect
CreateIcon

Sections

.text
Size: 41KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE