df52063b5714d0a1251e0adda61661cc | Triage

Sharing

General

Target

df52063b5714d0a1251e0adda61661cc
Size

176KB
MD5

df52063b5714d0a1251e0adda61661cc
SHA1

04b0373da0ec71df5c75a2ebdecb81b0bb89988b
SHA256

e90570681a204629c396363ad1ea0eaf7e8e9f66cd2191327eb7c314c3e7d240
SHA512

75627469999e2c020bffe5ed47f1cbf94839021b90719554e8fcc3be06cb2577bcda44612f9e727ba81b808ca68c8b7791cb916b96c78872e22aebe655a3e639
SSDEEP

3072:fQ7vJWI+/9yddC5l+S4nmqbrOhtI1nibkNdouizECwzicd:Y8I+/YddC5lOnxbCyn4kNdoJzECwF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
df52063b5714d0a1251e0adda61661cc

Files

df52063b5714d0a1251e0adda61661cc
.exe windows:4 windows x86 arch:x86

d7d1d9220fda366adaa448e60361b06f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

clusapi

CloseCluster

kernel32

GetLongPathNameW
GetWindowsDirectoryA
MultiByteToWideChar
GetVersion
InterlockedIncrement
lstrcpynA
SetThreadContext
GetModuleFileNameA
GetFileAttributesA
EnumResourceNamesA
DisableThreadLibraryCalls
InitializeCriticalSection
GetProcAddress
ExitProcess
InterlockedDecrement
LoadLibraryA
DeleteCriticalSection
GetLocaleInfoA

user32

GetActiveWindow
CharNextA
GetKeyState
UnregisterClassA
MoveWindow
ReleaseDC
PtInRect
GetDlgItem
GetWindowRect
EndPaint
SetWindowLongA
OffsetRect
SetWindowRgn
LoadAcceleratorsA
GetDC
EqualRect
IntersectRect
DefWindowProcA
SetDlgItemTextA
SetFocus
DestroyWindow
BeginPaint
SetParent

Sections

.text
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1024B - Virtual size: 248KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ