cc44cd86dc948e5cedf568be748e3471 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cc44cd86dc948e5cedf568be748e3471
Size

155KB
MD5

cc44cd86dc948e5cedf568be748e3471
SHA1

50e2f74019b23a0e93d37b703d778d2fac8b9de2
SHA256

e49b78980af333886f693daf36382b588a68d8f40ca631a90f26896709ca6a50
SHA512

e54bbc4dfd28a790f453ab5eeac9d4880ab63f285ecd6dfe128f3d93e883cd843f23f1fe7f054cda1ac13a483e5d672bc0ac4360c82e45d7fc8c4b1f896c75ab
SSDEEP

3072:odetHXfywWNzBfnv75XIYwESYXcQYDEWJNVdy:bnGfnv9XIYqcY5NC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cc44cd86dc948e5cedf568be748e3471

Files

cc44cd86dc948e5cedf568be748e3471
.exe windows:4 windows x86 arch:x86

b940cadb80c6ab17c0d6c9725b30af77

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

winword.pdb

Imports

kernel32

ExitProcess
FormatMessageA
GetLastError
SetLastError
VirtualAlloc
CloseHandle
MapViewOfFile
CreateFileMappingA
VirtualFree
GetProcAddress
VirtualProtect
LoadLibraryA
GetModuleHandleA
GetModuleFileNameW
UnmapViewOfFile
HeapFree
lstrcpynW
GetFullPathNameW
SetEnvironmentVariableW
HeapAlloc
GetProcessHeap
GetFileSize
ReadFile
SetFilePointer
CreateFileW
WideCharToMultiByte
Sleep
MoveFileW
GetSystemTimeAsFileTime
DeleteFileW
lstrcpyW
lstrlenW
GetEnvironmentVariableW

user32

MessageBoxA

Exports

Exports

DllGetLCID
wdCommandDispatch
wdGetApplicationObject

Sections

.text
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.res
Size: 145KB - Virtual size: 148KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 136B - Virtual size: 11.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE