e1b5c756fd1a5bb5102bdd31e8a70a13 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e1b5c756fd1a5bb5102bdd31e8a70a13
Size

295KB
MD5

e1b5c756fd1a5bb5102bdd31e8a70a13
SHA1

ccb95ca9386b84e8775be109fd8994d7f9287bf1
SHA256

35f041d5b5a8fe33d3e99d2f67468e85dbb9e237afc3597b6e2b38dc32920b0e
SHA512

ff1a291f00edb711d78bcd2daf02a02eea910d452ec4f46073b4fcf69e69e171cda2b60f8efdd22910fab6aab9ebbf68cd4e414f996c2d8d8c61f2ad27418d22
SSDEEP

6144:PTDHWjDEhXD/JdXsJzAtby6DYBHWN6wjcmxmr6Eq4yhiH3Wkmw:PKDUXjgBAk6DYBQ6awnPyMH3Wkmw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e1b5c756fd1a5bb5102bdd31e8a70a13

Files

e1b5c756fd1a5bb5102bdd31e8a70a13
.exe windows:4 windows x86 arch:x86

32daacf80026d380cb103540d48a5a3e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

avicap32

capCreateCaptureWindowA

advapi32

AdjustTokenPrivileges

wsock32

WSAAsyncGetHostByName

winspool.drv

ClosePrinter

comctl32

ImageList_Add

gdi32

BitBlt

shell32

SHGetSpecialFolderLocation

user32

ActivateKeyboardLayout

winmm

mciSendStringA

ole32

IsEqualGUID

oleaut32

SysAllocStringLen

urlmon

URLDownloadToFileA

Sections

.text
Size: 281KB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE