d3c171a8bbd292f79d8a696a38c1c658 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d3c171a8bbd292f79d8a696a38c1c658
Size

57KB
MD5

d3c171a8bbd292f79d8a696a38c1c658
SHA1

2e2dab4b49a549973ff1023d47bc880e999868ba
SHA256

5cb6e514e7151bb930e3cc0a9f0e834b61e082b3fb68e58cb543fd0c5540b8e1
SHA512

bb7fc19bc6501b8b46912795594c45b63cd2d055b331f8ddfb66febacc457e27d327feef4f67df15fcddf786c17d08d293e6135a32ea0aeb880b0c277cd8c4ad
SSDEEP

1536:nBfQayxQWRqCFx/CPvmEpzfEmy9HobuMH9f3:nB4aKRv/a1Rcmy+x

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d3c171a8bbd292f79d8a696a38c1c658

Files

d3c171a8bbd292f79d8a696a38c1c658
.exe windows:4 windows x86 arch:x86

233d43c85d3e6d8c909589d1c7274413

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

SetCursor
LoadImageA
GetMessageA
DrawTextA

kernel32

SetEndOfFile
lstrcmpA
WriteFile
VirtualAlloc
TlsSetValue
EnterCriticalSection
EnumResourceLanguagesA
EnumResourceNamesA
GetModuleHandleA
GetStartupInfoA
LoadLibraryA
Sleep

ole32

CoInitializeSecurity
OleCreateLink
WriteClassStg
CoGetCurrentProcess

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

code
Size: 17KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 34KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE