de56d3e1e19ae03cfee012787093743c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

de56d3e1e19ae03cfee012787093743c
Size

179KB
MD5

de56d3e1e19ae03cfee012787093743c
SHA1

afa3fe7fa031fb4961bcc5a864b4eaa10548dba1
SHA256

dd12e6de64a3213e2aee37a63735ac03e47ffcf36051e23a3b4562724c2ec82c
SHA512

3f1612e8d216d362709242c94c4c089a91b9e2909720c95c25c5bf2746144aae1bf5c20b6a846aac98a017f8087c7c119c3ce5ecb12457e9a904be91f83efa3b
SSDEEP

3072:Y+1av9lB2gs+rYQb7VxWqRrTXOTAN7c+zxUfU1EbfE1OC/Dag5ZnRi7h+8gEex7p:v1C9lFYC7VxfhKsBc+zxU7bfE1OC+6nN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
de56d3e1e19ae03cfee012787093743c

Files

de56d3e1e19ae03cfee012787093743c
.exe windows:4 windows x86 arch:x86

f4089fe30323b0998ab170aa1ab245a6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

version

VerQueryValueA

gdi32

UnrealizeObject

ole32

CreateStreamOnHGlobal

comctl32

ImageList_SetIconSize

Sections

CODE
Size: 171KB - Virtual size: 508KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE