cab0b23479ab10e3ad92ef1cf0875a91 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cab0b23479ab10e3ad92ef1cf0875a91
Size

429KB
MD5

cab0b23479ab10e3ad92ef1cf0875a91
SHA1

2b22e4b064e9ec68b6fd1d0ce6b2545a01b1305d
SHA256

4e0dc9e4a5676f2774797304858ab64adef4c762d002ce3f8cce2e97747233fa
SHA512

13899a780fc107968ec40e76287282318d8ca56c3ddf8bdb6b0afb5416e0bb099f53e6036c3caf79fa79613140ac72af9c1d8283bd150042d0b55d5c70a6b824
SSDEEP

6144:iwphNoWTqqJEaVRjy0+R9oBhMtAMlEfD1sxbVL9ao7ietCe0MCa9zRZwKTY9iqq:lNbTJDBPUuBut3lErABcy+MCwvY9iqq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cab0b23479ab10e3ad92ef1cf0875a91

Files

cab0b23479ab10e3ad92ef1cf0875a91
.exe windows:4 windows x86 arch:x86

869fac6e264765ad6c4e928cdf06e278

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdiplus

GdipAlloc
GdipCreateBitmapFromFile

kernel32

FindResourceExW
FindResourceW
LCMapStringA
LoadResource
LocalFree
GetVersionExA
FindAtomA
lstrlenA
HeapAlloc
HeapFree
GetTickCount
GetProcessHeap
GetLastError
IsProcessInJob
ExitProcess

gdi32

GetFontData
DeleteObject

user32

GetKeyState
KillTimer
SendMessageA
SetTimer
LoadIconA
LoadCursorA
RegisterClassA
CreateWindowExA
PostMessageA

Sections

.text
Size: 287KB - Virtual size: 287KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 135KB - Virtual size: 447KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ