d528b86015d1cce0933c0c786e68e482 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d528b86015d1cce0933c0c786e68e482
Size

137KB
MD5

d528b86015d1cce0933c0c786e68e482
SHA1

fc0d24ae0501231295cd03d4022f7a45acc22781
SHA256

caab562303343d01e1df89ea45be75e1f514397210b726d56d05c15cb39a029b
SHA512

de7e3b230c5d36472086bf659c4a6499aac8659c21a530fa4799ec373816feaf236cf20e76ff32ed485d1247520f040613ee7a384fbdc40a224106d856b5a72e
SSDEEP

3072:GDV2qXsR3JfjmkqkG+NGd+4GTdDO375an1SCP4i9:pR5mk3Na+7ZDOA1SCJ9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d528b86015d1cce0933c0c786e68e482

Files

d528b86015d1cce0933c0c786e68e482
.exe windows:4 windows x86 arch:x86

f53bcc90c89074d09c5bcb2856afb15c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ImageList_ReplaceIcon
ImageList_Destroy
ImageList_Remove
ImageList_DragShowNolock

shell32

Shell_NotifyIconW
StrNCmpW
SheFullPathW
SheRemoveQuotesW

kernel32

FindNextFileW
GetCommProperties
ConvertDefaultLocale
GetComputerNameW

ntdll

NtCancelTimer
NtClose
NtAccessCheckByType
NtClearEvent
NlsAnsiCodePage

Sections

.text
Size: 53KB - Virtual size: 91KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 46KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE