c6b4a2eb53f687988c0427cf752d429f | Triage

Sharing

General

Target

c6b4a2eb53f687988c0427cf752d429f
Size

455KB
MD5

c6b4a2eb53f687988c0427cf752d429f
SHA1

d6b3299043950047524087631f72375b68bfc36d
SHA256

786a583ea35093cc588069ed3b8d4dd6dbe8e9edfe68569d3752c6da82db0de1
SHA512

ded0daa7672ade2aabf1695c67441c0c488b8f44170ebd438105936eeac2a4d9fb7da1aef48565bb42caf6807eb4f0157a0de43ddf4731e5d3c428e8cf034dee
SSDEEP

12288:TdmwkAYHSHrxntq1FM3LIU1pJJpjNc91662/TeIXL:TfzksOCL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c6b4a2eb53f687988c0427cf752d429f

Files

c6b4a2eb53f687988c0427cf752d429f
.exe windows:5 windows x86 arch:x86

afd3cf9306370305eb4da817c6e9bf2b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

DrawAnimatedRects
keybd_event
DrawIcon
GetTabbedTextExtentW
DrawEdge
GrayStringA
GetDC
SetUserObjectSecurity
AppendMenuA
EnumPropsExW

oleaut32

CreateTypeLib2
VariantCopy
SafeArrayRedim
VarI4FromDec
DispInvoke
VarUI4FromDisp

shlwapi

StrCmpNIW
StrChrIA
StrRChrA

shell32

Shell_NotifyIconW
WOWShellExecute
ShellAboutA

winspool.drv

DeletePrinterDataExA
AddPortW
AdvancedDocumentPropertiesW
EXTDEVICEMODE
EnumFormsW
DeletePrinterDriverA
DeletePrintProcessorA
DocumentPropertiesW

dbghelp

ImageRvaToVa
SymGetLineFromAddr64
ImageDirectoryEntryToDataEx

ws2_32

WSAStartup
WSALookupServiceNextW
WSARecvDisconnect
WSAStringToAddressA
listen

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ