d766429196af4a74213f195c0c30e2ea | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d766429196af4a74213f195c0c30e2ea
Size

245KB
MD5

d766429196af4a74213f195c0c30e2ea
SHA1

29da4f88a76e554f0e1b585605f8f92715ab534f
SHA256

e3c1e593d526aa8f55dca6b589ce8d121ebc3e7fa7a1344bbaa9db0ef78af88d
SHA512

7afc37821fc9eb438cbc13ae10ee995626ebca4c725666cbe736f822fc56a2b404ee35855ea403c8ecd76decec45753023d76ab504da0cb73de2270be842a0bb
SSDEEP

6144:3AudjfLq3qXonFRVakxMH+lUpqQzYv+lLAFl8Bm/TvRk4JXRqzAWsAEb:9iDiPQQz96F5kkRqzAHLb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d766429196af4a74213f195c0c30e2ea

Files

d766429196af4a74213f195c0c30e2ea
.exe windows:6 windows x86 arch:x86

b89f3af6e8726c625cba8a18b46cbaf3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

imm32

ImmGetDefaultIMEWnd

normaliz

IdnToNameprepUnicode
IdnToUnicode

shlwapi

PathStripPathA
StrStrIA
PathAddExtensionW

kernel32

VerLanguageNameA
GetConsoleWindow
IsValidLocaleName
VirtualProtect
QueryPerformanceCounter
GetUserDefaultLangID
OutputDebugStringA
CreateTapePartition

pdh

PdhGetCounterTimeBase
PdhVbGetCounterPathElements
PdhSelectDataSourceA
PdhVbCreateCounterPathList
PdhFormatFromRawValue

winmm

midiOutGetID
midiInClose
joyReleaseCapture
DriverCallback
joyGetDevCapsA
PlaySoundA

rtutils

RouterAssert
LogErrorW
TracePutsExW
MprSetupProtocolFree
TraceVprintfExA
TraceDeregisterA
RouterGetErrorStringW

wsnmp32

ord504
ord902
ord107
ord400
ord200
ord104

user32

GetWindowContextHelpId
SetClipboardViewer
ShowWindow

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ