0ab098f6c38c7c850c92b82d89edade5581548acae2b80499af10eca066af827 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0ab098f6c38c7c850c92b82d89edade5581548acae2b80499af10eca066af827
Size

465KB
MD5

f962138883874d0b0066aa76e7dd9e00
SHA1

f9434728989c272860fb4cfc069f480c27fad5cf
SHA256

0ab098f6c38c7c850c92b82d89edade5581548acae2b80499af10eca066af827
SHA512

ec81ab7865333e6fa7f9729d5485f53187884ff340c66e4d3b61a7ac05bd2238c3b7b24a160c92d0aa6d3a5723c9b54604e6345e353f9d3e6e6c7e1407c55175
SSDEEP

3072:mLtkcR/5ks/ttjJDCzFII5ar3Cbs5Um4rqrTHqDFT:cXbjCFIIMSw5UpkaF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0ab098f6c38c7c850c92b82d89edade5581548acae2b80499af10eca066af827

Files

0ab098f6c38c7c850c92b82d89edade5581548acae2b80499af10eca066af827
.exe windows:4 windows x86 arch:x86

720c886028db8a7751d3b002098f0b27

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

version

VerQueryValueA

urlmon

UrlMkGetSessionOption

shell32

SHGetSpecialFolderLocation

wsock32

WSACleanup

ntdll

NtQueryInformationProcess

rpcrt4

UuidCreateSequential

Sections

CODE
Size: 118KB - Virtual size: 360KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE