ca6a42183267533649218152aaf2cc18 | Triage

Sharing

General

Target

ca6a42183267533649218152aaf2cc18
Size

636KB
MD5

ca6a42183267533649218152aaf2cc18
SHA1

3e986ee36f991a7e6f0affbc08063f01afa36421
SHA256

9ef680afd58c4946829a674e36f1d42aaae36fe745053cbf92670689b6bbf4d0
SHA512

ca09470d6371c8c26128af4f95eccf022f5d828e0d56afe46ab794e38dc842e4dbcd6b2e8cb02a83581314aa6135a4f7c45558a31826c6ec2b1069e8063590ae
SSDEEP

12288:a8X+2kl6i3Bq+/m+yeVS7OjkLbEfy9c8FaEGHXnu06vlLUqqLNhZxXxyvIg:N+V6i3BTyee3LbEfy9/qX/RdNZxKIg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ca6a42183267533649218152aaf2cc18

Files

ca6a42183267533649218152aaf2cc18
.exe windows:4 windows x86 arch:x86

eeadae2bbd82d9dc77a8f6005c499e3d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetSystemDefaultLangID
VirtualProtect
LocalSize
HeapReAlloc
GetCommandLineA
GetVersion
GlobalUnlock
WaitForMultipleObjects
CloseHandle
GetTickCount
GetConsoleDisplayMode
lstrlenA
HeapCreate
GetModuleHandleA
SuspendThread
InterlockedExchange
GetAtomNameA
GetConsoleCP
WaitForSingleObject
LoadLibraryExA
CompareFileTime

gdi32

CreateFontA
CreateICA
FloodFill
GetRgnBox
GetMetaRgn
EndPath
GetFontData
DeleteDC
EngLineTo
AbortPath
Escape
EqualRgn
GetStringBitmapA
DeleteObject
Ellipse
CreatePalette
GetMetaFileA
GetTextColor
BeginPath

rastapi

AddPorts
DeviceDone
PortClose
DeviceConnect
DeviceListen

dhcpsapi

DhcpAddServer

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ