4660af403b5edb1dc22822dc637d6173 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4660af403b5edb1dc22822dc637d6173
Size

467KB
MD5

4660af403b5edb1dc22822dc637d6173
SHA1

e570a530eecf87bad331eae6b6db17fe1189b59b
SHA256

bd345d6e4c2616ba3675ed315fb0441367a07e089475f4e0439f3b4ddd7196cf
SHA512

31f5d73c0b7fe8712b3e7d3efa4d97cf2628efb559b8568153e4baf88d4b4862d2dfafb9907940c5e220e05a40c6a7987a01e6fb36207fd430b68422f4b84d6d
SSDEEP

3072:0LtkcR/5ks/ttjJDCzFII5ar3Cbs5Um4rqrTHqDFT:qXbjCFIIMSw5UpkaF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4660af403b5edb1dc22822dc637d6173

Files

4660af403b5edb1dc22822dc637d6173
.exe windows:4 windows x86 arch:x86

720c886028db8a7751d3b002098f0b27

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

version

VerQueryValueA

urlmon

UrlMkGetSessionOption

shell32

SHGetSpecialFolderLocation

wsock32

WSACleanup

ntdll

NtQueryInformationProcess

rpcrt4

UuidCreateSequential

Sections

CODE
Size: 118KB - Virtual size: 360KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE