d400df7cc286beb87f0522c9251626b4 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d400df7cc286beb87f0522c9251626b4
Size

277KB
MD5

d400df7cc286beb87f0522c9251626b4
SHA1

48a1471c07092f40478c421970786e549dccbb77
SHA256

1b77070407492a030cbafab4ff3cc32b77b5442f33608e1eba42186fb3ed9cca
SHA512

d41d07f9f34c27651b481e21e4a1fab8aec8f22e37bf6bb51262030ca835ba12a9205859b48bb3eb901b4f0ec952151060c117572ed81816fd540aae7342fc84
SSDEEP

6144:oAJdk/sxS8Nmgp6hXaKCFM+YeFpIwj+ejYwII6Nh:DJdkumgUa7F1Yo3rde

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d400df7cc286beb87f0522c9251626b4

Files

d400df7cc286beb87f0522c9251626b4
.exe windows:4 windows x86 arch:x86

d1737170ee26af0b1b3b7e123637bebe

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

UrlApplySchemeW
UrlGetPartW
UrlCanonicalizeW
UrlCombineW
PathCombineW
PathAppendW

msimg32

TransparentBlt

wtsapi32

WTSUnRegisterSessionNotification
WTSFreeMemory
WTSEnumerateSessionsW
WTSQuerySessionInformationW
WTSRegisterSessionNotification

oleacc

LresultFromObject
AccessibleObjectFromEvent

kernel32

GetOEMCP
HeapFree
WriteFile
LoadLibraryA
RtlUnwind
GetStringTypeA
IsDebuggerPresent
GetCPInfo
LCMapStringW
LCMapStringA
EnumResourceTypesW
GetCurrentProcess
ResetWriteWatch
VirtualAlloc
GetStringTypeW
InterlockedExchange
SetUnhandledExceptionFilter
GetACP
GetLocaleInfoA

Sections

.text
Size: 137KB - Virtual size: 136KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 137KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ