d46852d2b96326ff39e35a5c767971f9 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d46852d2b96326ff39e35a5c767971f9
Size

329KB
MD5

d46852d2b96326ff39e35a5c767971f9
SHA1

77ac43b0a89a5a1225a9427469cc3447c5018baa
SHA256

4997944b8d8e4caec940a3f396c548bf119d5b323dcb87be1789beaf9185b360
SHA512

e0061a21b12acd12cd33a48724eb6fb5b466daa504488882e66497fcd35c1a52cb8f92d96932227f7121596ec4c511e8f9c5aa19f223ca5e61767070160e4b7f
SSDEEP

6144:XmrPkndhxHTe/bw1wxDEdltPu+QvWwojm7hTUJGtpWeotSxttE2/2:WAnlcVDAl9QdSG1UJGPogz92

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d46852d2b96326ff39e35a5c767971f9

Files

d46852d2b96326ff39e35a5c767971f9
.exe windows:4 windows x86 arch:x86

796b10f599be0ee9dcf6cd6f77a3794c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
ExitProcess

user32

DrawTextExA

gdi32

AddFontResourceA

comdlg32

GetSaveFileNameA

advapi32

RegOpenKeyExA

shell32

ShellExecuteA

ole32

CoCreateInstance

comctl32

ord17

Sections

pec1
Size: 22KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 49KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pec
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 30KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

llbddem
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 223KB - Virtual size: 224KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE