dea5298d4d44155f83323f44cd9eec21 | Triage

Sharing

General

Target

dea5298d4d44155f83323f44cd9eec21
Size

192KB
MD5

dea5298d4d44155f83323f44cd9eec21
SHA1

f87131a38ce4e7a91c0fa0bcfb8d0131a11ec9a2
SHA256

f405e45a64b4c05b21ae657e35d07e10d1e3efd0f80dc95ec8797b29ae03b167
SHA512

44b0b0ec6abc5d57a48acce3c63e5b8b27709809fe6096ac4098669abc46fbaa2f6a159d7b6d0225eb2bf53b633f04ea07a0f76728dadc531c5e438be555785e
SSDEEP

1536:fAljfmzzRybC6+k7LP6j4f8/ldqYFSRJlDaJoHkqesZg3SnKp:fmmzzRuNLiFUYU9ZnKp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dea5298d4d44155f83323f44cd9eec21

Files

dea5298d4d44155f83323f44cd9eec21
.exe windows:4 windows x86 arch:x86

b41deb5f969b99278a38389c0be8c3d6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

NtGetContextThread
NtSetContextThread
NtResumeThread
NtWriteVirtualMemory
NtUnmapViewOfSection
NtAllocateVirtualMemory

urlmon

URLDownloadToFileW

shell32

ShellExecuteW

user32

CallWindowProcW
FindWindowW
PostMessageW

kernel32

GetFileAttributesW
DeleteFileW
CreateProcessW
GetModuleFileNameW
GetSystemDirectoryW
CopyFileW
Sleep
SetFileAttributesW
CreateDirectoryW
GetEnvironmentVariableW

msvbvm60

ord582
ord583
ord584
__vbaLenBstr
ord516
ord660
ord593
ord594
ord520
VarPtr
ord632
DllFunctionCall
ord601
__vbaExceptHandler
ord608
ProcCallEngine
ord535
ord573
ord575
ord100
ord546
ord581

Sections

.text
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 168KB - Virtual size: 165KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE