e0ed159df2bb6b451816b8b48fd77ccb | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e0ed159df2bb6b451816b8b48fd77ccb
Size

356KB
MD5

e0ed159df2bb6b451816b8b48fd77ccb
SHA1

129362088a2f298ea4bfc38bcbbbc36b629ee850
SHA256

4ef740da98b7a23dc32bf94dcf2f83aa48285d2c09859e59b456a0f2025b2b35
SHA512

c516b05638eb60e9db4e833721cfd01ed92793d2d43bdcaa05aa3287886c24e09096507f86642497a18290f3dedb9aa9d62afa1d9e6c820c1a651f92b32b2212
SSDEEP

6144:r61FoHY1j12PbimfGsE6m4FtWfAvpofL0tJ1PDi7wfaZwln/6kgUB9Z5Dr5kCvjb:lcj12PGYEgvIE9Di7orlikjOCvjbD0vL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e0ed159df2bb6b451816b8b48fd77ccb

Files

e0ed159df2bb6b451816b8b48fd77ccb
.exe windows:5 windows x86 arch:x86

e218f655f036f569d7a87ccfa333d177

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

FTTTGR.pdb

Imports

kernel32

GlobalFindAtomA
EnumSystemLocalesA
GetLocaleInfoW
GlobalAddAtomW
DeleteVolumeMountPointW
LockFile
EraseTape
GetProcessAffinityMask
SetFileAttributesW
GetConsoleCursorInfo
FindFirstFileA
LoadLibraryA
GetModuleHandleA
GetProcAddress
GetCurrentConsoleFont
FillConsoleOutputAttribute

wininet

RetrieveUrlCacheEntryStreamW

winspool.drv

FindNextPrinterChangeNotification

powrprof

IsPwrHibernateAllowed
ReadGlobalPwrPolicy

user32

GetClipboardFormatNameA
ShowCaret
InsertMenuA
GetWindowRect
SetCursor
IsWindow

gdi32

GetPaletteEntries
GetCharWidthW
GetBitmapBits
GetObjectW

Sections

.rda
Size: 300KB - Virtual size: 299KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data1
Size: 20KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ