c734de4444a0d8ef11911008d5a6c4b9 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c734de4444a0d8ef11911008d5a6c4b9
Size

77KB
MD5

c734de4444a0d8ef11911008d5a6c4b9
SHA1

b6aa684cd6bf349e31833972244344859cc6f106
SHA256

a6dea32afe595c34d97d4a818cbb0a027abeb95b498bc09491839bcfeab1ab28
SHA512

93dba5d13170af5259ff0701cc64826003692c91baa86bdefe5ff0e19d89134c18cc6aa672d7cbd9be123b1cac1e2088343f7ef85a5d748b5c758b9f3095b010
SSDEEP

1536:vv0WzZ7UDVhcPF2V8zqsFzcUw+7CVWlNg4lrbqCF5pxf22c3+:vBUDVhcPF2mesBS+7CVYrz122cu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c734de4444a0d8ef11911008d5a6c4b9

Files

c734de4444a0d8ef11911008d5a6c4b9
.exe windows:4 windows x86 arch:x86

31a29c11c09426dbc1c1bf2cd6557c1c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memcmp
strstr
memcpy

user32

GetActiveWindow
DrawIcon
DestroyCaret
FillRect
GetMonitorInfoW
GetShellWindow

advapi32

ReadEventLogW
RegFlushKey
DecryptFileW
ReportEventW
OpenThreadToken

wininet

FreeUrlCacheSpaceA
GopherFindFirstFileA
GopherOpenFileW
FtpGetFileW
HttpQueryInfoA

Sections

.text
Size: 48KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 24KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE