c68dc582f455248cf8926dbbd13aacee | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c68dc582f455248cf8926dbbd13aacee
Size

3.5MB
MD5

c68dc582f455248cf8926dbbd13aacee
SHA1

c4f7efa4fad1724696506372df44022c00c024aa
SHA256

4af972633da29b91c8d527ee6e2df6e6eecff0f9b42918417e13b521e7ee5a39
SHA512

db62b80df156509deef225db302ebac59d21e6d5aa10abc227d3f53cb6e9120e9a9baf738803d285306e73ab1f3a33943910e552beb45588125e457a943e4e21
SSDEEP

98304:4bu6hLdVgih1WKRMsG5ZfA3ylEuL4LMYvN4C:MJ1f2WjNMYvN7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c68dc582f455248cf8926dbbd13aacee

Files

c68dc582f455248cf8926dbbd13aacee
.exe windows:5 windows x86 arch:x86

96778352d99ca84b52328b0725ee1935

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

user32

GetDesktopWindow

advapi32

GetUserNameA

shell32

SHFileOperationA

shlwapi

PathMatchSpecW

psapi

GetModuleFileNameExA

wininet

DeleteUrlCacheEntry

gdiplus

GdipGetImageEncodersSize

Sections

.MPRESS1
Size: 3.4MB - Virtual size: 8.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE