eb662cc740bbdd0abba93ba4d8a6f8165306c5dc5984a66a9e261034ca6e036a | Triage

Sharing

General

Target

eb662cc740bbdd0abba93ba4d8a6f8165306c5dc5984a66a9e261034ca6e036a
Size

353KB
MD5

20f6af37361fd93eca71195d9d4d3da1
SHA1

fe432fff607831ee18aaee6987bce8a421d13f90
SHA256

eb662cc740bbdd0abba93ba4d8a6f8165306c5dc5984a66a9e261034ca6e036a
SHA512

e8a96ddd3eaddb063d2da58f8ca9c9c9f8a7027119353dca8cc8aabef86961eee55c650f3ab7eab6be02a52539482d57a1c61abfa507400d3ae32e1472fca0fd
SSDEEP

6144:TYUTxSfmI9HkzI6I9hmliFIsp4E8gb2QxmJW:TYxfbE06Jli3BnSQUs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eb662cc740bbdd0abba93ba4d8a6f8165306c5dc5984a66a9e261034ca6e036a

Files

eb662cc740bbdd0abba93ba4d8a6f8165306c5dc5984a66a9e261034ca6e036a
.exe windows:5 windows x86 arch:x86

eb72c8b416e71facfb6beb377e02c6b5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReadFile
VirtualAlloc
CloseHandle
CreateFileW
DeviceIoControl
GetModuleHandleA
GetDriveTypeW
GetLastError
GetModuleHandleW
GetStartupInfoA
LocalFree
FormatMessageW
ExitProcess

user32

DialogBoxParamA
SetFocus
LoadCursorA
LoadIconW
LoadIconA
LoadCursorW
DialogBoxParamW
EnableWindow
GetDesktopWindow
GetDlgItem
IsDlgButtonChecked
LoadStringW
MessageBoxW
AnimateWindow
EndDialog

advapi32

RegOpenKeyExW

msvcrt

_XcptFilter
__getmainargs
__p__commode
__p__fmode
__set_app_type
__setusermatherr
_acmdln
_adjust_fdiv
_c_exit
_cexit
_controlfp
_except_handler3
_exit
_initterm
exit

Sections

.text
Size: 207KB - Virtual size: 207KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ropf
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ