5030fb21f8fa84ad0f74a7594e28122e | Triage

Sharing

General

Target

5030fb21f8fa84ad0f74a7594e28122e
Size

170KB
MD5

5030fb21f8fa84ad0f74a7594e28122e
SHA1

9848ffd8a6a449f95c7fd4234f95906b62ecd8d9
SHA256

ddc720ebfe2883c3bf002f142487054d2bf4a1643cc7acc6e65d0fb236c7499b
SHA512

8423fe68ddc913e7fe44ef4ca9ecc40b3fe877dc672525dc1924a31dbec1a1034afcc1777957223a1df96b1186631cc1b9ecc2f0fd5296692b577c6e3673fd8a
SSDEEP

3072:51qOrqEtChvcbjlANq9bG4t7EDPUcZP49KReQp+H9kqaj661St83Ug:LnrqDWb6aGY0PU39KR989qbSng

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5030fb21f8fa84ad0f74a7594e28122e

Files

5030fb21f8fa84ad0f74a7594e28122e
.exe windows:5 windows x86 arch:x86

f020e1a2feae651f7ce88318f285b500

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
GetProcAddress
VirtualAlloc
VirtualFree
VirtualProtect

user32

EndPaint

gdi32

BitBlt

advapi32

OpenProcessToken

shell32

ShellExecuteW

ws2_32

WSAStartup

Sections

.text
Size: 73KB - Virtual size: 154KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 12KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1KB - Virtual size: 275KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 74KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.EEEE
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE