79af394c8705c26ed971ff8bfcab9e34fb6645bf81c6903868971877ee127e97 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

79af394c8705c26ed971ff8bfcab9e34fb6645bf81c6903868971877ee127e97
Size

481KB
MD5

1db9077d65ff313d197639725138ff37
SHA1

c62ff13fac278d55af59a2c3bb9779df5cd96e4b
SHA256

79af394c8705c26ed971ff8bfcab9e34fb6645bf81c6903868971877ee127e97
SHA512

029de2f5be8fe89264b6cfb7475ec6f62b9741f3687d902e90e4cba4e7f5ffaf67bc40ef413094bd77dda5bdc19b4740262d3cff348b85b372735de0029e42ed
SSDEEP

12288:9PTveekpmU2GxQA5dZWkZK6nPqM+WcD4ellNrr/2:9I24QAhWhWMHD4MlNH2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
79af394c8705c26ed971ff8bfcab9e34fb6645bf81c6903868971877ee127e97

Files

79af394c8705c26ed971ff8bfcab9e34fb6645bf81c6903868971877ee127e97
.exe windows:5 windows x86 arch:x86

5ee0d146292a4d3cd3e543dd755df065

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

SetWindowTextW

advapi32

RegQueryValueExW

shell32

ShellExecuteA

ws2_32

gethostbyaddr

iphlpapi

GetAdaptersInfo

wtsapi32

WTSRegisterSessionNotification

oleacc

LresultFromObject

gdi32

DeleteDC

winspool.drv

OpenPrinterW

oleaut32

VariantClear

Sections

.text
Size: 448KB - Virtual size: 524KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 24B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE