c9052c4de6142bf445888b31385d3200 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c9052c4de6142bf445888b31385d3200
Size

280KB
MD5

c9052c4de6142bf445888b31385d3200
SHA1

704a056b6133049a316750c9aabb243d939d8aa0
SHA256

285bd01a4a9b9c5d19e82c3e38641b56738931dc2d240eca8b7a60148ce7909d
SHA512

d26483f82271916f22ab762f1c6690162a173252f215189267206cabc197a417675b2daf56395e9820adce2f395a4ae1d21f36ca6d009e8d0e8a03553fdfe025
SSDEEP

6144:Llxw07oX6cKkhsNPhzOrOgOYA/AWdeeFUqthFIf6az67G:xx7vcKkhSP4a6sfs6am7G

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c9052c4de6142bf445888b31385d3200

Files

c9052c4de6142bf445888b31385d3200
.exe windows:4 windows x86 arch:x86

c42bf4107481f4960a34f220d5944482

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

shell32

ShellExecuteA

Sections

CODE
Size: 273KB - Virtual size: 408KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE