ce013f42ed272f17d6997dc1ca7187fd | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ce013f42ed272f17d6997dc1ca7187fd
Size

284KB
MD5

ce013f42ed272f17d6997dc1ca7187fd
SHA1

81acde511b76c1fb6a6787f21090dd207b5973a0
SHA256

72f5acb429b3047e0e7d164ca6e8d90b525ed1970bff47e0ce101625c236339c
SHA512

dc6449208ee42bf210df0f365a539e226a1aaa9d287a86c5bc74e8ac69f66220e8796d7f208c6b440d0fcb90b6f0811bddfb7f8381334a2b3f965ecfc317f785
SSDEEP

3072:a+RUj0h+jH5N4q+dsv7A3yRJhuCP/G+6RJaQVX:a+8Hr9+yM3HCP/GTJak

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ce013f42ed272f17d6997dc1ca7187fd

Files

ce013f42ed272f17d6997dc1ca7187fd
.exe windows:4 windows x86 arch:x86

82def858cfda4ffd279405004e127eb3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RtlMoveMemory

msvbvm60

MethCallEngine
ord516
ord632
EVENT_SINK_AddRef
DllFunctionCall
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord607
ord608
ProcCallEngine
ord644
ord573
ord100
ord617
ord619

Sections

.text
Size: 112KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 168KB - Virtual size: 168KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE